theory CNode_DP

lemma seL4_CNode_Move_sep:
  "\<lbrace>\<lambda>s. \<guillemotleft>
     root_tcb_id \<mapsto>f tcb \<and>*
     (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>*

     \<comment> \<open>Root CNode.\<close>
     cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
     \<comment> \<open>Client cnode.\<close>
     dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>*

     \<comment> \<open>Cap to the root CNode.\<close>
     (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
     \<comment> \<open>Cap to the client CNode.\<close>
     (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>*
     \<comment> \<open>Cap that the root task has to its own CNode.\<close>
     (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>*
     \<comment> \<open>Cap to be copied, in the root CNode.\<close>
     (cnode_id, src_slot) \<mapsto>c src_cap \<and>*
     \<comment> \<open>Where to copy the cap (in the client CNode).\<close>
     (dest_id, dest_slot) \<mapsto>c NullCap \<and>*
      R\<guillemotright> s \<and>

     one_lvl_lookup cnode_cap 32 root_size \<and>
     one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and>
     one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and>

     \<comment> \<open>We need some word invariants\<close>
     unat src_depth \<le> word_bits \<and>
     0 < unat src_depth \<and>
     unat dest_depth \<le> word_bits \<and>
     0 < unat dest_depth \<and>

     is_tcb tcb \<and>
     is_cnode_cap dest_root_cap \<and>
     is_cnode_cap cnode_cap \<and>
     is_cnode_cap cnode_cap' \<and>
     guard_equal cnode_cap' src_index (unat src_depth) \<and>
     guard_equal cnode_cap src_index (unat src_depth) \<and>
     guard_equal dest_root_cap dest_index (unat dest_depth ) \<and>
     guard_equal cnode_cap src_root word_bits \<and>
     guard_equal cnode_cap dest_root word_bits \<and>

     \<comment> \<open>Caps point to the right objects.\<close>
     cap_object cnode_cap = cnode_id \<and>
     cap_object cnode_cap' = cnode_id \<and>
     cap_object dest_root_cap = dest_id \<and>

     \<comment> \<open>Cap slots match their cptrs.\<close>
     dest_root_slot = offset dest_root root_size \<and>
     cnode_cap_slot = offset src_root root_size \<and>
     src_slot = offset src_index root_size \<and>
     dest_slot = offset dest_index dest_size \<and>

     src_cap \<noteq> NullCap
   \<rbrace>
  seL4_CNode_Move dest_root dest_index dest_depth src_root src_index src_depth
  \<lbrace>\<lambda>_. \<guillemotleft> root_tcb_id \<mapsto>f tcb \<and>*
       cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
       dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>*
       (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
       (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*
       (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>*
       (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>*
       (cnode_id, src_slot) \<mapsto>c NullCap \<and>*
       (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R\<guillemotright>\<rbrace>" apply (simp add:seL4_CNode_Move_def sep_state_projection2_def) apply (rule do_kernel_op_pull_back) apply (rule hoare_pre) apply (rule_tac
               intent_op = "CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)"
           and intent_cptr = dest_root
           and intent_extra = "[src_root]" in call_kernel_with_intent_no_fault_helper) apply (clarsimp simp:sep_conj_assoc) apply (rule hoare_post_imp[OF _ set_cap_wp]) apply (sep_select 5,assumption) apply wp apply wp apply (rule_tac P = "\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and>
                                iv = InvokeCNode (MoveCall dcap
                                                    (cap_object cnode_cap', offset src_index root_size)
                                                    (cap_object dest_root_cap, offset dest_index dest_size))"
           in hoare_gen_asmEx) apply clarsimp apply (rule false_e_explode) apply (rule no_exception_conj') apply (wp cnode_move_cap_cdl_current_thread)[1] apply (rule no_exception_conj') apply wp[1] apply (rule hoare_post_impErr) apply (rule_tac R = "(root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* R" for R
             in invoke_cnode_move_cap) apply clarsimp apply (rule conjI[rotated]) apply (rule sep_any_imp_c'_conj[where cap = RestartCap]) apply (subst(asm) sep_map_c_asid_reset[where cap' = "src_cap"]) apply simp apply (sep_solve) apply sep_solve apply (assumption) apply (rule_tac Q = "\<lambda>r. < (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* Q>
          and (\<lambda>a. cdl_current_thread a = Some root_tcb_id
                 \<and> cdl_current_domain a = minBound) and K(\<exists>dcap.
           reset_cap_asid dcap = reset_cap_asid src_cap \<and>
           iv = InvokeCNode
           (MoveCall dcap
           (cap_object cnode_cap', offset src_index root_size)
           (cap_object dest_root_cap, offset dest_index dest_size)))" for Q
          in hoare_strengthen_post[rotated]) apply (clarsimp) apply (sep_select 3,assumption) apply (wp set_cap_wp set_cap_all_scheduable_tcbs) apply (rule_tac P = "is_cnode_cap c" in hoare_gen_asmEx) apply (simp add:decode_invocation_simps) apply (rule liftME_wp) apply (rule decode_cnode_move_rvu) apply (simp add:lookup_extra_caps_def Let_def
        mapME_def sequenceE_def get_index_def) apply (rule wp_no_exception_seq) apply wp apply (rule lookup_cap_and_slot_rvu[where r = root_size]) apply (rule lookup_cap_and_slot_rvu[where r = root_size]) apply (rule validE_validE_R) apply (rule hoare_pre) apply (rule lookup_cap_and_slot_rvu[where r = root_size]) apply (clarsimp simp:get_index_def) defer apply (wp hoare_vcg_ball_lift sep_inv_to_all_scheduable_tcbs[OF update_thread_intent_update]
     hoare_vcg_imp_lift hoare_vcg_ex_lift hoare_vcg_all_lift
     update_thread_intent_update update_thread_cnode_at | clarsimp simp:Let_def)+ apply (clarsimp simp:conj_comms) apply (intro conjI impI ballI) apply (clarsimp dest!:sep_map_f_tcb_at simp:object_at_def) apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def) apply (intro conjI,simp+) apply (clarsimp simp:sep_conj_assoc) apply sep_solve[1] apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def) apply (intro conjI allI) apply (simp add:cnode_non_ep cong: cap_type_bad_cong)+ apply (clarsimp simp:sep_conj_assoc) apply sep_solve[1] apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def) apply (intro conjI allI) apply (fastforce cong: cap_type_bad_cong)+ apply (drule(1) reset_cap_asid_cnode_cap | simp | fast)+ apply (clarsimp simp:sep_conj_assoc) apply sep_solve[1] apply (clarsimp cong: cap_type_bad_cong) apply sep_solve apply (simp add:sep_any_map_c_imp) apply (clarsimp simp:user_pointer_at_def
          Let_def word_bits_def cnode_cap_non_ep_related) apply (clarsimp simp:sep_conj_assoc) apply (intro conjI,fastforce+) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. Separation_SD.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap\<rbrace> seL4_CNode_Move dest_root dest_index dest_depth src_root src_index src_depth \<lbrace>\<lambda>_. Separation_SD.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> False) \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> False \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q2\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> False \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)\<rbrace>
 2. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> ?Q2 s proof (prove)
goal (12 subgoals):
 1. cdl_intent_op \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = dest_root \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> = [src_root]
 2. \<lbrace>?R5\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)\<rbrace>
 3. \<lbrace>?Ra5\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R5\<rbrace>
 4. \<lbrace>?Rb5\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra5\<rbrace>
 5. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb5 s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 6. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 7. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 8. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 9. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<lbrace>?R5\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)\<rbrace>
 2. \<lbrace>?Ra5\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R5\<rbrace>
 3. \<lbrace>?Rb5\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra5\<rbrace>
 4. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb5 s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 5. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 6. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 7. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 10. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* ?R7) s \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s
 2. \<lbrace>?Ra5\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R7)\<rbrace>
 3. \<lbrace>?Rb5\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra5\<rbrace>
 4. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb5 s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 5. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 6. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 7. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 10. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<lbrace>?Ra5\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)\<rbrace>
 2. \<lbrace>?Rb5\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra5\<rbrace>
 3. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb5 s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 4. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 6. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 9. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 10. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<lbrace>?Rb5\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)\<rbrace>
 2. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb5 s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>iv. \<lbrace>?PIV5 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV5 iv\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>iv. \<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<Longrightarrow> \<lbrace>?P'19 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'19 iv and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P'19 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = dest_root \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [src_root]) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.5 s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'19 iv and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P'19 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>_ _. False\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'19 iv and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P'30 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id\<rbrace>, -
 2. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P31 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P31 iv and ?P'30 iv and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P31 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P31 iv and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P'41 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound\<rbrace>, -
 2. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P42 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P42 iv and ?P'41 iv and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P42 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P42 iv and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (10 subgoals):
 1. \<And>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> \<lbrace>?P42 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace> invoke_cnode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)) \<lbrace>?Q49 dcap\<rbrace>, \<lbrace>?E49 dcap\<rbrace>
 2. \<And>dcap rv s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?Q49 dcap rv s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s
 3. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 4. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P42 iv and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 6. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 9. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 10. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<And>dcap rv s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s
 2. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (9 subgoals):
 1. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s
 2. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (10 subgoals):
 1. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s
 2. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 3. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 4. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 6. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 9. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 10. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (10 subgoals):
 1. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s
 2. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 3. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 4. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 6. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 9. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 10. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (11 subgoals):
 1. \<And>dcap s. reset_cap_asid dcap = reset_cap_asid src_cap \<Longrightarrow> reset_cap_asid dcap = reset_cap_asid src_cap
 2. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra70 dcap (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s
 3. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 4. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 5. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 6. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 7. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 10. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>dcap. ?Ra70 dcap (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?Ra59 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (10 subgoals):
 1. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra70 dcap (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R) s
 2. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 3. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 4. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Ra59 iv) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 6. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 9. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 10. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?Ra70 dcap (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?Ra59 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (9 subgoals):
 1. \<And>dcap s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c dcap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 2. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 3. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 5. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 8. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 9. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>dcap e s. \<lbrakk>reset_cap_asid dcap = reset_cap_asid src_cap; ?E49 dcap e s\<rbrakk> \<Longrightarrow> False
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (7 subgoals):
 1. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 2. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 3. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 6. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 7. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>iv rv s. (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 iv) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s \<Longrightarrow> (cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 iv \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 iv) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (8 subgoals):
 1. \<And>s dcap. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) s; cdl_current_thread s = Some root_tcb_id; cdl_current_domain s = minBound; reset_cap_asid dcap = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s
 2. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q123 iv) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 4. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 7. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 8. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s) proof (prove)
goal (7 subgoals):
 1. \<And>iv. \<lbrace>?Ps5 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap136 iv \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound) and K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>
 2. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>?Ps5\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 3. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 6. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 7. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. \<lbrace>?Pd5 cs c ref\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>\<lambda>iv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap136 iv \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) s\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 2. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?Pd5 xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 5. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 6. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. is_cnode_cap c \<Longrightarrow> \<lbrace>?P'155 c ref cs\<rbrace> decode_invocation c ref cs (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>\<lambda>iv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap136 iv \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> K (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) s\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 2. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'155 (fst r) (snd r) xa and K (is_cnode_cap (fst r))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 5. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 6. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. is_cnode_cap c \<Longrightarrow> \<lbrace>?P'155 c ref cs\<rbrace> liftME InvokeCNode (decode_cnode_invocation c ref cs (CNodeMoveIntent dest_index dest_depth src_index src_depth)) \<lbrace>\<lambda>iv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap136 iv \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> iv = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 2. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'155 (fst r) (snd r) xa and K (is_cnode_cap (fst r))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 5. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 6. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. is_cnode_cap c \<Longrightarrow> \<lbrace>?P'155 c ref cs\<rbrace> decode_cnode_invocation c ref cs (CNodeMoveIntent dest_index dest_depth src_index src_depth) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap136 (InvokeCNode r) \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> InvokeCNode r = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))\<rbrace>, \<lbrace>\<lambda>xa s. False\<rbrace>
 2. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. ?P'155 (fst r) (snd r) xa and K (is_cnode_cap (fst r))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 5. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 6. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (5 subgoals):
 1. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [src_root] \<lbrace>\<lambda>xa. (\<lambda>a. CNodeMoveIntent dest_index dest_depth src_index src_depth = CNodeMoveIntent (?dest_index160 (fst r) (snd r) xa) (?dest_depth160 (fst r) (snd r) xa) (?src_index160 (fst r) (snd r) xa) (?src_depth160 (fst r) (snd r) xa) \<and> get_index xa 0 = Some (?cap160 (fst r) (snd r) xa, ?cap_ref160 (fst r) (snd r) xa) \<and> ?src_cap160 (fst r) (snd r) xa \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap160 (fst r) (snd r) xa) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) xa), offset (?src_index160 (fst r) (snd r) xa) (?sz160 (fst r) (snd r) xa)) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) xa) (?sz'160 (fst r) (snd r) xa)))) \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> (\<exists>dcap. reset_cap_asid dcap = reset_cap_asid src_cap \<and> InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) xa), offset (?src_index160 (fst r) (snd r) xa) (?sz160 (fst r) (snd r) xa)) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) xa) (?sz'160 (fst r) (snd r) xa))) = InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size)))) \<and> unat (?src_depth160 (fst r) (snd r) xa) \<le> word_bits \<and> 0 < unat (?src_depth160 (fst r) (snd r) xa) \<and> unat (?dest_depth160 (fst r) (snd r) xa) \<le> word_bits \<and> 0 < unat (?dest_depth160 (fst r) (snd r) xa) \<and> cdl.lift (\<box> (?sz160 (fst r) (snd r) xa, unat (?src_depth160 (fst r) (snd r) xa)) : ?cap160 (fst r) (snd r) xa ?src_index160 (fst r) (snd r) xa \<mapsto>u ?src_cap160 (fst r) (snd r) xa \<and>* \<box> (?sz'160 (fst r) (snd r) xa, unat (?dest_depth160 (fst r) (snd r) xa)) : fst r ?dest_index160 (fst r) (snd r) xa \<mapsto>u NullCap \<and>* ?R160 (fst r) (snd r) xa) a) and K (is_cnode_cap (fst r))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 4. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 5. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (5 subgoals):
 1. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id src_root;
returnOk [x]
odE \<lbrace>\<lambda>xa s. dest_index = ?dest_index160 (fst r) (snd r) xa \<and> dest_depth = ?dest_depth160 (fst r) (snd r) xa \<and> src_index = ?src_index160 (fst r) (snd r) xa \<and> src_depth = ?src_depth160 (fst r) (snd r) xa \<and> (if xa \<noteq> [] then Some (xa ! 0) else None) = Some (?cap160 (fst r) (snd r) xa, ?cap_ref160 (fst r) (snd r) xa) \<and> ?src_cap160 (fst r) (snd r) xa \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap160 (fst r) (snd r) xa) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) xa), offset (?src_index160 (fst r) (snd r) xa) (?sz160 (fst r) (snd r) xa)) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) xa) (?sz'160 (fst r) (snd r) xa)))) \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap160 (fst r) (snd r) xa) = cap_object cnode_cap' \<and> offset (?src_index160 (fst r) (snd r) xa) (?sz160 (fst r) (snd r) xa) = offset src_index root_size \<and> cap_object (fst r) = cap_object dest_root_cap \<and> offset (?dest_index160 (fst r) (snd r) xa) (?sz'160 (fst r) (snd r) xa) = offset dest_index dest_size) \<and> unat (?src_depth160 (fst r) (snd r) xa) \<le> word_bits \<and> 0 < unat (?src_depth160 (fst r) (snd r) xa) \<and> unat (?dest_depth160 (fst r) (snd r) xa) \<le> word_bits \<and> 0 < unat (?dest_depth160 (fst r) (snd r) xa) \<and> cdl.lift (\<box> (?sz160 (fst r) (snd r) xa, unat (?src_depth160 (fst r) (snd r) xa)) : ?cap160 (fst r) (snd r) xa ?src_index160 (fst r) (snd r) xa \<mapsto>u ?src_cap160 (fst r) (snd r) xa \<and>* \<box> (?sz'160 (fst r) (snd r) xa, unat (?dest_depth160 (fst r) (snd r) xa)) : fst r ?dest_index160 (fst r) (snd r) xa \<mapsto>u NullCap \<and>* ?R160 (fst r) (snd r) xa) s \<and> is_cnode_cap (fst r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 4. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 5. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (6 subgoals):
 1. \<And>r ra. \<lbrace>?P'164 r ra\<rbrace> returnOk [ra] \<lbrace>\<lambda>xa s. dest_index = ?dest_index160 (fst r) (snd r) xa \<and> dest_depth = ?dest_depth160 (fst r) (snd r) xa \<and> src_index = ?src_index160 (fst r) (snd r) xa \<and> src_depth = ?src_depth160 (fst r) (snd r) xa \<and> (if xa \<noteq> [] then Some (xa ! 0) else None) = Some (?cap160 (fst r) (snd r) xa, ?cap_ref160 (fst r) (snd r) xa) \<and> ?src_cap160 (fst r) (snd r) xa \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap160 (fst r) (snd r) xa) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) xa), offset (?src_index160 (fst r) (snd r) xa) (?sz160 (fst r) (snd r) xa)) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) xa) (?sz'160 (fst r) (snd r) xa)))) \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap160 (fst r) (snd r) xa) = cap_object cnode_cap' \<and> offset (?src_index160 (fst r) (snd r) xa) (?sz160 (fst r) (snd r) xa) = offset src_index root_size \<and> cap_object (fst r) = cap_object dest_root_cap \<and> offset (?dest_index160 (fst r) (snd r) xa) (?sz'160 (fst r) (snd r) xa) = offset dest_index dest_size) \<and> unat (?src_depth160 (fst r) (snd r) xa) \<le> word_bits \<and> 0 < unat (?src_depth160 (fst r) (snd r) xa) \<and> unat (?dest_depth160 (fst r) (snd r) xa) \<le> word_bits \<and> 0 < unat (?dest_depth160 (fst r) (snd r) xa) \<and> cdl.lift (\<box> (?sz160 (fst r) (snd r) xa, unat (?src_depth160 (fst r) (snd r) xa)) : ?cap160 (fst r) (snd r) xa ?src_index160 (fst r) (snd r) xa \<mapsto>u ?src_cap160 (fst r) (snd r) xa \<and>* \<box> (?sz'160 (fst r) (snd r) xa, unat (?dest_depth160 (fst r) (snd r) xa)) : fst r ?dest_index160 (fst r) (snd r) xa \<mapsto>u NullCap \<and>* ?R160 (fst r) (snd r) xa) s \<and> is_cnode_cap (fst r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id src_root \<lbrace>?P'164 r\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 5. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 6. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (5 subgoals):
 1. \<And>r. \<lbrace>?Pd1.5 (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id src_root \<lbrace>\<lambda>ra a. dest_index = ?dest_index160 (fst r) (snd r) [ra] \<and> dest_depth = ?dest_depth160 (fst r) (snd r) [ra] \<and> src_index = ?src_index160 (fst r) (snd r) [ra] \<and> src_depth = ?src_depth160 (fst r) (snd r) [ra] \<and> (if [ra] \<noteq> [] then Some ([ra] ! 0) else None) = Some (?cap160 (fst r) (snd r) [ra], ?cap_ref160 (fst r) (snd r) [ra]) \<and> ?src_cap160 (fst r) (snd r) [ra] \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap160 (fst r) (snd r) [ra]) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [ra]), offset (?src_index160 (fst r) (snd r) [ra]) (?sz160 (fst r) (snd r) [ra])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [ra]) (?sz'160 (fst r) (snd r) [ra])))) \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap160 (fst r) (snd r) [ra]) = cap_object cnode_cap' \<and> offset (?src_index160 (fst r) (snd r) [ra]) (?sz160 (fst r) (snd r) [ra]) = offset src_index root_size \<and> cap_object (fst r) = cap_object dest_root_cap \<and> offset (?dest_index160 (fst r) (snd r) [ra]) (?sz'160 (fst r) (snd r) [ra]) = offset dest_index dest_size) \<and> unat (?src_depth160 (fst r) (snd r) [ra]) \<le> word_bits \<and> 0 < unat (?src_depth160 (fst r) (snd r) [ra]) \<and> unat (?dest_depth160 (fst r) (snd r) [ra]) \<le> word_bits \<and> 0 < unat (?dest_depth160 (fst r) (snd r) [ra]) \<and> cdl.lift (\<box> (?sz160 (fst r) (snd r) [ra], unat (?src_depth160 (fst r) (snd r) [ra])) : ?cap160 (fst r) (snd r) [ra] ?src_index160 (fst r) (snd r) [ra] \<mapsto>u ?src_cap160 (fst r) (snd r) [ra] \<and>* \<box> (?sz'160 (fst r) (snd r) [ra], unat (?dest_depth160 (fst r) (snd r) [ra])) : fst r ?dest_index160 (fst r) (snd r) [ra] \<mapsto>u NullCap \<and>* ?R160 (fst r) (snd r) [ra]) a \<and> is_cnode_cap (fst r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ?Pd1.5 (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 4. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 5. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (4 subgoals):
 1. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>r s. ((\<forall>c. reset_cap_asid c = reset_cap_asid (?cap'238 (fst r) (snd r)) \<longrightarrow> dest_index = ?dest_index237 (fst r) (snd r) c \<and> dest_depth = ?dest_depth236 (fst r) (snd r) c \<and> src_index = ?src_index235 (fst r) (snd r) c \<and> src_depth = ?src_depth234 (fst r) (snd r) c \<and> (if [(c, cap_object (?cap233 (fst r) (snd r)), offset src_root root_size)] \<noteq> [] then Some ([(c, cap_object (?cap232 (fst r) (snd r)), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst r) (snd r) c, ?cap_ref230 (fst r) (snd r) c) \<and> ?src_cap229 (fst r) (snd r) c \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst r) (snd r) c) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst r) (snd r) c src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst r) (snd r) c) = cap_object cnode_cap' \<and> offset (?src_index225 (fst r) (snd r) c) (?sz224 (fst r) (snd r) c) = offset src_index root_size \<and> cap_object (fst r) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst r) (snd r) c) (?sz'222 (fst r) (snd r) c) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst r) (snd r) c) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst r) (snd r) c) \<and> unat (?dest_depth219 (fst r) (snd r) c) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst r) (snd r) c) \<and> cdl.lift (\<box> (?sz217 (fst r) (snd r) c, unat (?src_depth216 (fst r) (snd r) c)) : ?cap215 (fst r) (snd r) c ?src_index214 (fst r) (snd r) c \<mapsto>u ?src_cap213 (fst r) (snd r) c \<and>* \<box> (?sz'212 (fst r) (snd r) c, unat (?dest_depth211 (fst r) (snd r) c)) : fst r ?dest_index210 (fst r) (snd r) c \<mapsto>u NullCap \<and>* ?R209 (fst r) (snd r) c) s \<and> is_cnode_cap (fst r)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst r) (snd r) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst r) (snd r) src_root \<mapsto>u ?cap'206 (fst r) (snd r) \<and>* ?R205 (fst r) (snd r)) s) \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<lbrace>?Pd2.5\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 3. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.5\<rbrace>
 4. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'206 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'238 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap207 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap233 (fst r) (snd r)
\<lambda>r. ?cap207 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap232 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap207 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap208 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<lbrace>\<lambda>s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) \<longrightarrow> dest_index = ?dest_index237 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> dest_depth = ?dest_depth236 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_index = ?src_index235 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_depth = ?src_depth234 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, ?cap_ref230 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> ?src_cap229 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = cap_object cnode_cap' \<and> offset (?src_index225 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz224 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap239, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz'222 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> unat (?dest_depth219 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> cdl.lift (\<box> (?sz217 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?src_depth216 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : ?cap215 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca ?src_index214 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u ?src_cap213 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and>* \<box> (?sz'212 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?dest_depth211 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : fst (c, cap_object ?cap239, offset dest_root root_size) ?dest_index210 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u NullCap \<and>* ?R209 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) s \<and> is_cnode_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) src_root \<mapsto>u ?cap'206 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* ?R205 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, -
 2. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) \<longrightarrow> dest_index = ?dest_index237 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> dest_depth = ?dest_depth236 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_index = ?src_index235 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_depth = ?src_depth234 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, ?cap_ref230 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> ?src_cap229 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = cap_object cnode_cap' \<and> offset (?src_index225 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz224 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap239, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz'222 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> unat (?dest_depth219 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> cdl.lift (\<box> (?sz217 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?src_depth216 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : ?cap215 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca ?src_index214 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u ?src_cap213 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and>* \<box> (?sz'212 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?dest_depth211 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : fst (c, cap_object ?cap239, offset dest_root root_size) ?dest_index210 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u NullCap \<and>* ?R209 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) s \<and> is_cnode_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) src_root \<mapsto>u ?cap'206 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* ?R205 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrace>
 3. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<lbrace>\<lambda>s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) \<longrightarrow> dest_index = ?dest_index237 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> dest_depth = ?dest_depth236 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_index = ?src_index235 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_depth = ?src_depth234 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, ?cap_ref230 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> ?src_cap229 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = cap_object cnode_cap' \<and> offset (?src_index225 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz224 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap239, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz'222 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> unat (?dest_depth219 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> cdl.lift (\<box> (?sz217 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?src_depth216 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : ?cap215 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca ?src_index214 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u ?src_cap213 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and>* \<box> (?sz'212 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?dest_depth211 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : fst (c, cap_object ?cap239, offset dest_root root_size) ?dest_index210 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u NullCap \<and>* ?R209 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) s \<and> is_cnode_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) src_root \<mapsto>u ?cap'206 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* ?R205 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) \<longrightarrow> dest_index = ?dest_index237 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> dest_depth = ?dest_depth236 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_index = ?src_index235 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_depth = ?src_depth234 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, ?cap_ref230 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> ?src_cap229 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = cap_object cnode_cap' \<and> offset (?src_index225 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz224 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap239, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz'222 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> unat (?dest_depth219 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> cdl.lift (\<box> (?sz217 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?src_depth216 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : ?cap215 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca ?src_index214 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u ?src_cap213 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and>* \<box> (?sz'212 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?dest_depth211 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : fst (c, cap_object ?cap239, offset dest_root root_size) ?dest_index210 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u NullCap \<and>* ?R209 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) s \<and> is_cnode_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) src_root \<mapsto>u ?cap'206 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* ?R205 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrace>
 3. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (4 subgoals):
 1. \<lbrace>?Q242\<rbrace> lookup_cap_and_slot root_tcb_id dest_root \<lbrace>\<lambda>rv s. \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) \<longrightarrow> dest_index = ?dest_index237 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> dest_depth = ?dest_depth236 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_index = ?src_index235 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_depth = ?src_depth234 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, ?cap_ref230 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> ?src_cap229 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = cap_object cnode_cap' \<and> offset (?src_index225 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz224 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap239, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz'222 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> unat (?dest_depth219 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> cdl.lift (\<box> (?sz217 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?src_depth216 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : ?cap215 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca ?src_index214 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u ?src_cap213 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and>* \<box> (?sz'212 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?dest_depth211 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : fst (c, cap_object ?cap239, offset dest_root root_size) ?dest_index210 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u NullCap \<and>* ?R209 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) s \<and> is_cnode_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) src_root \<mapsto>u ?cap'206 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* ?R205 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s \<Longrightarrow> ?Q242 s
 3. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) \<longrightarrow> dest_index = ?dest_index237 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> dest_depth = ?dest_depth236 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_index = ?src_index235 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_depth = ?src_depth234 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, ?cap_ref230 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> ?src_cap229 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = cap_object cnode_cap' \<and> offset (?src_index225 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz224 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap239, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz'222 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> unat (?dest_depth219 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> cdl.lift (\<box> (?sz217 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?src_depth216 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : ?cap215 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca ?src_index214 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u ?src_cap213 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and>* \<box> (?sz'212 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?dest_depth211 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : fst (c, cap_object ?cap239, offset dest_root root_size) ?dest_index210 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u NullCap \<and>* ?R209 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) s \<and> is_cnode_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) src_root \<mapsto>u ?cap'206 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* ?R205 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrace>
 4. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) \<longrightarrow> dest_index = ?dest_index237 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> dest_depth = ?dest_depth236 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_index = ?src_index235 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_depth = ?src_depth234 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, ?cap_ref230 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> ?src_cap229 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = cap_object cnode_cap' \<and> offset (?src_index225 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz224 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap239, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz'222 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> unat (?dest_depth219 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> cdl.lift (\<box> (?sz217 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?src_depth216 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : ?cap215 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca ?src_index214 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u ?src_cap213 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and>* \<box> (?sz'212 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?dest_depth211 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : fst (c, cap_object ?cap239, offset dest_root root_size) ?dest_index210 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u NullCap \<and>* ?R209 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) s \<and> is_cnode_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) src_root \<mapsto>u ?cap'206 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* ?R205 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap (fst (c, cap_object ?cap245, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
 2. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) \<longrightarrow> dest_index = ?dest_index237 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> dest_depth = ?dest_depth236 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_index = ?src_index235 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_depth = ?src_depth234 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, ?cap_ref230 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> ?src_cap229 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = cap_object cnode_cap' \<and> offset (?src_index225 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz224 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap239, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz'222 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> unat (?dest_depth219 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> cdl.lift (\<box> (?sz217 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?src_depth216 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : ?cap215 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca ?src_index214 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u ?src_cap213 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and>* \<box> (?sz'212 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?dest_depth211 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : fst (c, cap_object ?cap239, offset dest_root root_size) ?dest_index210 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u NullCap \<and>* ?R209 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) s \<and> is_cnode_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) src_root \<mapsto>u ?cap'206 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* ?R205 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrace>
 3. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object ?cap239, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object ?cap239, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object ?cap239, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object ?cap239, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object ?cap239, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object ?cap239, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz224 c (cap_object ?cap239, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz'222 c (cap_object ?cap239, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object ?cap239, offset dest_root root_size) ca)) : ?cap215 c (cap_object ?cap239, offset dest_root root_size) ca ?src_index214 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object ?cap239, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object ?cap239, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object ?cap239, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 c (cap_object ?cap239, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
 2. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) \<longrightarrow> dest_index = ?dest_index237 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> dest_depth = ?dest_depth236 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_index = ?src_index235 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_depth = ?src_depth234 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, ?cap_ref230 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> ?src_cap229 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = cap_object cnode_cap' \<and> offset (?src_index225 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz224 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap239, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz'222 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> unat (?dest_depth219 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> cdl.lift (\<box> (?sz217 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?src_depth216 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : ?cap215 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca ?src_index214 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u ?src_cap213 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and>* \<box> (?sz'212 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?dest_depth211 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : fst (c, cap_object ?cap239, offset dest_root root_size) ?dest_index210 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u NullCap \<and>* ?R209 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) s \<and> is_cnode_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) src_root \<mapsto>u ?cap'206 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* ?R205 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrace>
 3. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<lbrace>?P5\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (CNodeIntent (CNodeMoveIntent dest_index dest_depth src_index src_depth)), cdl_intent_error = False, cdl_intent_cap = dest_root, cdl_intent_extras = [src_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) \<longrightarrow> dest_index = ?dest_index237 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> dest_depth = ?dest_depth236 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_index = ?src_index235 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> src_depth = ?src_depth234 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and> (if [(ca, cap_object (?cap233 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] \<noteq> [] then Some ([(ca, cap_object (?cap232 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))), offset src_root root_size)] ! 0) else None) = Some (?cap231 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, ?cap_ref230 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> ?src_cap229 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = cap_object cnode_cap' \<and> offset (?src_index225 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz224 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset src_index root_size \<and> cap_object (fst (c, cap_object ?cap239, offset dest_root root_size)) = cap_object dest_root_cap \<and> offset (?dest_index223 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) (?sz'222 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> unat (?dest_depth219 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) \<and> cdl.lift (\<box> (?sz217 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?src_depth216 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : ?cap215 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca ?src_index214 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u ?src_cap213 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<and>* \<box> (?sz'212 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca, unat (?dest_depth211 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca)) : fst (c, cap_object ?cap239, offset dest_root root_size) ?dest_index210 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca \<mapsto>u NullCap \<and>* ?R209 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) ca) s \<and> is_cnode_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* \<box> (root_size, word_bits) : ?cap207 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) src_root \<mapsto>u ?cap'206 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size)) \<and>* ?R205 (fst (c, cap_object ?cap239, offset dest_root root_size)) (snd (c, cap_object ?cap239, offset dest_root root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap239, offset dest_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrace>
 2. \<And>s. cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c src_cap \<and>* (dest_id, dest_slot) \<mapsto>c NullCap \<and>* R) s \<and> one_lvl_lookup cnode_cap 32 root_size \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> is_tcb tcb \<and> is_cnode_cap dest_root_cap \<and> is_cnode_cap cnode_cap \<and> is_cnode_cap cnode_cap' \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> guard_equal cnode_cap src_index (unat src_depth) \<and> guard_equal dest_root_cap dest_index (unat dest_depth) \<and> guard_equal cnode_cap src_root word_bits \<and> guard_equal cnode_cap dest_root word_bits \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object dest_root_cap = dest_id \<and> dest_root_slot = offset dest_root root_size \<and> cnode_cap_slot = offset src_root root_size \<and> src_slot = offset src_index root_size \<and> dest_slot = offset dest_index dest_size \<and> src_cap \<noteq> NullCap \<Longrightarrow> tcb_at' (\<lambda>tcb. True) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> ?P5 s)
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object ?cap239, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object ?cap239, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object ?cap239, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object ?cap239, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object ?cap239, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object ?cap239, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz224 c (cap_object ?cap239, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz'222 c (cap_object ?cap239, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object ?cap239, offset dest_root root_size) ca)) : ?cap215 c (cap_object ?cap239, offset dest_root root_size) ca ?src_index214 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object ?cap239, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object ?cap239, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object ?cap239, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 c (cap_object ?cap239, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size\<rbrakk> \<Longrightarrow> object_at (\<lambda>obj. \<exists>tcb. obj = Tcb tcb) root_tcb_id s \<and> (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x = reset_cap_asid ?cap'239 \<longrightarrow> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 x (cap_object ?cap239, offset dest_root root_size) xa \<and> dest_depth = ?dest_depth236 x (cap_object ?cap239, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object ?cap239, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object ?cap239, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object ?cap239, offset dest_root root_size) xa \<and> (cap_object (?cap232 x (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 x (cap_object ?cap239, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object ?cap239, offset dest_root root_size) xa \<noteq> NullCap \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object ?cap239, offset dest_root root_size) xa) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object ?cap239, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object ?cap239, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?src_index225 x (cap_object ?cap239, offset dest_root root_size) xa) (?sz224 x (cap_object ?cap239, offset dest_root root_size) xa) = offset src_index root_size \<and> cap_object x = cap_object dest_root_cap \<and> offset (?dest_index223 x (cap_object ?cap239, offset dest_root root_size) xa) (?sz'222 x (cap_object ?cap239, offset dest_root root_size) xa) = offset dest_index dest_size) \<and> unat (?src_depth221 x (cap_object ?cap239, offset dest_root root_size) xa) \<le> word_bits \<and> 0 < unat (?src_depth220 x (cap_object ?cap239, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object ?cap239, offset dest_root root_size) xa) \<le> word_bits \<and> 0 < unat (?dest_depth218 x (cap_object ?cap239, offset dest_root root_size) xa) \<and> cdl.lift (\<box> (?sz217 x (cap_object ?cap239, offset dest_root root_size) xa, unat (?src_depth216 x (cap_object ?cap239, offset dest_root root_size) xa)) : ?cap215 x (cap_object ?cap239, offset dest_root root_size) xa ?src_index214 x (cap_object ?cap239, offset dest_root root_size) xa \<mapsto>u ?src_cap213 x (cap_object ?cap239, offset dest_root root_size) xa \<and>* \<box> (?sz'212 x (cap_object ?cap239, offset dest_root root_size) xa, unat (?dest_depth211 x (cap_object ?cap239, offset dest_root root_size) xa)) : x ?dest_index210 x (cap_object ?cap239, offset dest_root root_size) xa \<mapsto>u NullCap \<and>* ?R209 x (cap_object ?cap239, offset dest_root root_size) xa) s \<and> is_cnode_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 x (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 x (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 x (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 x (cap_object ?cap239, offset dest_root root_size)) s \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s)
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object ?cap239, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object ?cap239, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object ?cap239, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object ?cap239, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object ?cap239, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object ?cap239, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz224 c (cap_object ?cap239, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz'222 c (cap_object ?cap239, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object ?cap239, offset dest_root root_size) ca)) : ?cap215 c (cap_object ?cap239, offset dest_root root_size) ca ?src_index214 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object ?cap239, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object ?cap239, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object ?cap239, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 c (cap_object ?cap239, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size\<rbrakk> \<Longrightarrow> object_at (\<lambda>obj. \<exists>tcb. obj = Tcb tcb) root_tcb_id s \<and> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s \<and> (\<forall>x. reset_cap_asid x = reset_cap_asid ?cap'239 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 x (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 x (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 x (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 x (cap_object ?cap239, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object ?cap239, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object ?cap239, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object ?cap239, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object ?cap239, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object ?cap239, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object ?cap239, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object ?cap239, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object ?cap239, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object ?cap239, offset dest_root root_size) xa) \<le> word_bits \<and> unat (?src_depth221 x (cap_object ?cap239, offset dest_root root_size) xa) \<le> word_bits \<and> (cap_object (?cap232 x (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 x (cap_object ?cap239, offset dest_root root_size) xa \<and> cdl.lift (\<box> (?sz217 x (cap_object ?cap239, offset dest_root root_size) xa, unat (?src_depth216 x (cap_object ?cap239, offset dest_root root_size) xa)) : ?cap215 x (cap_object ?cap239, offset dest_root root_size) xa ?src_index214 x (cap_object ?cap239, offset dest_root root_size) xa \<mapsto>u ?src_cap213 x (cap_object ?cap239, offset dest_root root_size) xa \<and>* \<box> (?sz'212 x (cap_object ?cap239, offset dest_root root_size) xa, unat (?dest_depth211 x (cap_object ?cap239, offset dest_root root_size) xa)) : x ?dest_index210 x (cap_object ?cap239, offset dest_root root_size) xa \<mapsto>u NullCap \<and>* ?R209 x (cap_object ?cap239, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object ?cap239, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object ?cap239, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object ?cap239, offset dest_root root_size) xa) (?sz'222 x (cap_object ?cap239, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object ?cap239, offset dest_root root_size) xa) (?sz224 x (cap_object ?cap239, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object ?cap239, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s))))
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object ?cap239, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object ?cap239, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object ?cap239, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object ?cap239, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object ?cap239, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object ?cap239, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz224 c (cap_object ?cap239, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz'222 c (cap_object ?cap239, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object ?cap239, offset dest_root root_size) ca)) : ?cap215 c (cap_object ?cap239, offset dest_root root_size) ca ?src_index214 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object ?cap239, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object ?cap239, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object ?cap239, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 c (cap_object ?cap239, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size\<rbrakk> \<Longrightarrow> object_at (\<lambda>obj. \<exists>tcb. obj = Tcb tcb) root_tcb_id s
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s
 3. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid ?cap'239 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 x (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 x (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 x (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 x (cap_object ?cap239, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object ?cap239, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object ?cap239, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object ?cap239, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object ?cap239, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object ?cap239, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object ?cap239, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object ?cap239, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object ?cap239, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object ?cap239, offset dest_root root_size) xa) \<le> word_bits \<and> unat (?src_depth221 x (cap_object ?cap239, offset dest_root root_size) xa) \<le> word_bits \<and> (cap_object (?cap232 x (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 x (cap_object ?cap239, offset dest_root root_size) xa \<and> cdl.lift (\<box> (?sz217 x (cap_object ?cap239, offset dest_root root_size) xa, unat (?src_depth216 x (cap_object ?cap239, offset dest_root root_size) xa)) : ?cap215 x (cap_object ?cap239, offset dest_root root_size) xa ?src_index214 x (cap_object ?cap239, offset dest_root root_size) xa \<mapsto>u ?src_cap213 x (cap_object ?cap239, offset dest_root root_size) xa \<and>* \<box> (?sz'212 x (cap_object ?cap239, offset dest_root root_size) xa, unat (?dest_depth211 x (cap_object ?cap239, offset dest_root root_size) xa)) : x ?dest_index210 x (cap_object ?cap239, offset dest_root root_size) xa \<mapsto>u NullCap \<and>* ?R209 x (cap_object ?cap239, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object ?cap239, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object ?cap239, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object ?cap239, offset dest_root root_size) xa) (?sz'222 x (cap_object ?cap239, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object ?cap239, offset dest_root root_size) xa) (?sz224 x (cap_object ?cap239, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object ?cap239, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s))
 4. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object ?cap239, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object ?cap239, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object ?cap239, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object ?cap239, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object ?cap239, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object ?cap239, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz224 c (cap_object ?cap239, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz'222 c (cap_object ?cap239, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object ?cap239, offset dest_root root_size) ca)) : ?cap215 c (cap_object ?cap239, offset dest_root root_size) ca ?src_index214 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object ?cap239, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object ?cap239, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object ?cap239, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 c (cap_object ?cap239, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid ?cap'239 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 x (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 x (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 x (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 x (cap_object ?cap239, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object ?cap239, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object ?cap239, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object ?cap239, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object ?cap239, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object ?cap239, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object ?cap239, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object ?cap239, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object ?cap239, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object ?cap239, offset dest_root root_size) xa) \<le> word_bits \<and> unat (?src_depth221 x (cap_object ?cap239, offset dest_root root_size) xa) \<le> word_bits \<and> (cap_object (?cap232 x (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 x (cap_object ?cap239, offset dest_root root_size) xa \<and> cdl.lift (\<box> (?sz217 x (cap_object ?cap239, offset dest_root root_size) xa, unat (?src_depth216 x (cap_object ?cap239, offset dest_root root_size) xa)) : ?cap215 x (cap_object ?cap239, offset dest_root root_size) xa ?src_index214 x (cap_object ?cap239, offset dest_root root_size) xa \<mapsto>u ?src_cap213 x (cap_object ?cap239, offset dest_root root_size) xa \<and>* \<box> (?sz'212 x (cap_object ?cap239, offset dest_root root_size) xa, unat (?dest_depth211 x (cap_object ?cap239, offset dest_root root_size) xa)) : x ?dest_index210 x (cap_object ?cap239, offset dest_root root_size) xa \<mapsto>u NullCap \<and>* ?R209 x (cap_object ?cap239, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object ?cap239, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object ?cap239, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object ?cap239, offset dest_root root_size) xa) (?sz'222 x (cap_object ?cap239, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object ?cap239, offset dest_root root_size) xa) (?sz224 x (cap_object ?cap239, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object ?cap239, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s))
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object ?cap239, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object ?cap239, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object ?cap239, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object ?cap239, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object ?cap239, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object ?cap239, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz224 c (cap_object ?cap239, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz'222 c (cap_object ?cap239, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object ?cap239, offset dest_root root_size) ca)) : ?cap215 c (cap_object ?cap239, offset dest_root root_size) ca ?src_index214 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object ?cap239, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object ?cap239, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object ?cap239, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 c (cap_object ?cap239, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> one_lvl_lookup ?cap239 32 root_size \<and> guard_equal ?cap239 dest_root 32 \<and> is_cnode_cap ?cap239 \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* (cap_object ?cap239 \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object ?cap239, offset dest_root root_size) \<mapsto>c ?cap'239) \<and>* ?R239) s
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid ?cap'239 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 x (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 x (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 x (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 x (cap_object ?cap239, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object ?cap239, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object ?cap239, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object ?cap239, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object ?cap239, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object ?cap239, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object ?cap239, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object ?cap239, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object ?cap239, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object ?cap239, offset dest_root root_size) xa) \<le> word_bits \<and> unat (?src_depth221 x (cap_object ?cap239, offset dest_root root_size) xa) \<le> word_bits \<and> (cap_object (?cap232 x (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 x (cap_object ?cap239, offset dest_root root_size) xa \<and> cdl.lift (\<box> (?sz217 x (cap_object ?cap239, offset dest_root root_size) xa, unat (?src_depth216 x (cap_object ?cap239, offset dest_root root_size) xa)) : ?cap215 x (cap_object ?cap239, offset dest_root root_size) xa ?src_index214 x (cap_object ?cap239, offset dest_root root_size) xa \<mapsto>u ?src_cap213 x (cap_object ?cap239, offset dest_root root_size) xa \<and>* \<box> (?sz'212 x (cap_object ?cap239, offset dest_root root_size) xa, unat (?dest_depth211 x (cap_object ?cap239, offset dest_root root_size) xa)) : x ?dest_index210 x (cap_object ?cap239, offset dest_root root_size) xa \<mapsto>u NullCap \<and>* ?R209 x (cap_object ?cap239, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object ?cap239, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object ?cap239, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object ?cap239, offset dest_root root_size) xa) (?sz'222 x (cap_object ?cap239, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object ?cap239, offset dest_root root_size) xa) (?sz224 x (cap_object ?cap239, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object ?cap239, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s))
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object ?cap239, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object ?cap239, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object ?cap239, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object ?cap239, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object ?cap239, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object ?cap239, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object ?cap239, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object ?cap239, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object ?cap239, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object ?cap239, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz224 c (cap_object ?cap239, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object ?cap239, offset dest_root root_size) ca) (?sz'222 c (cap_object ?cap239, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object ?cap239, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object ?cap239, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object ?cap239, offset dest_root root_size) ca)) : ?cap215 c (cap_object ?cap239, offset dest_root root_size) ca ?src_index214 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object ?cap239, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object ?cap239, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object ?cap239, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object ?cap239, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object ?cap239, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object ?cap239, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object ?cap239, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object ?cap239, offset dest_root root_size) \<and>* ?R205 c (cap_object ?cap239, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap239 \<and>* \<box> (root_size, word_bits) : ?cap239 dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c ?cap'239) \<and>* ?R239) s
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid ?cap'239 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 x (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 x (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'206 x (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 x (cap_object cnode_cap, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> word_bits \<and> unat (?src_depth221 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> word_bits \<and> (cap_object (?cap232 x (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> cdl.lift (\<box> (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa, unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) : ?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa ?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa \<mapsto>u ?src_cap213 x (cap_object cnode_cap, offset dest_root root_size) xa \<and>* \<box> (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa, unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) : x ?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa \<mapsto>u NullCap \<and>* ?R209 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'222 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz224 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s))
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object cnode_cap, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz224 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz'222 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object cnode_cap, offset dest_root root_size) ca)) : ?cap215 c (cap_object cnode_cap, offset dest_root root_size) ca ?src_index214 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object cnode_cap, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c ?cap'239 \<and>* ?R239) s
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid ?cap'239 \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 x (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 x (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'206 x (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 x (cap_object cnode_cap, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> word_bits \<and> unat (?src_depth221 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> word_bits \<and> (cap_object (?cap232 x (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> cdl.lift (\<box> (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa, unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) : ?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa ?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa \<mapsto>u ?src_cap213 x (cap_object cnode_cap, offset dest_root root_size) xa \<and>* \<box> (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa, unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) : x ?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa \<mapsto>u NullCap \<and>* ?R209 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'222 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz224 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s))
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'239 \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object cnode_cap, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz224 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz'222 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object cnode_cap, offset dest_root root_size) ca)) : ?cap215 c (cap_object cnode_cap, offset dest_root root_size) ca ?src_index214 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object cnode_cap, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u ?cap'239 \<and>* ?R239) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> word_bits; 0 < unat src_depth; unat dest_depth \<le> word_bits; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root word_bits; guard_equal cnode_cap dest_root word_bits; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid dest_root_cap \<longrightarrow> \<not> ep_related_cap x \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 x (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 x (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'206 x (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 x (cap_object cnode_cap, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> word_bits \<and> unat (?src_depth221 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> word_bits \<and> (cap_object (?cap232 x (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> cdl.lift (\<box> (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa, unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) : ?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa ?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa \<mapsto>u ?src_cap213 x (cap_object cnode_cap, offset dest_root root_size) xa \<and>* \<box> (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa, unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) : x ?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa \<mapsto>u NullCap \<and>* ?R209 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'222 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz224 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s))
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object cnode_cap, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz224 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz'222 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object cnode_cap, offset dest_root root_size) ca)) : ?cap215 c (cap_object cnode_cap, offset dest_root root_size) ca ?src_index214 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object cnode_cap, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x \<and> one_lvl_lookup (?cap207 x (cap_object cnode_cap, offset dest_root root_size)) 32 root_size \<and> guard_equal (?cap207 x (cap_object cnode_cap, offset dest_root root_size)) src_root 32 \<and> is_cnode_cap (?cap207 x (cap_object cnode_cap, offset dest_root root_size)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 x (cap_object cnode_cap, offset dest_root root_size) \<and>* (cap_object (?cap207 x (cap_object cnode_cap, offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (?cap207 x (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) \<mapsto>c ?cap'206 x (cap_object cnode_cap, offset dest_root root_size)) \<and>* ?R205 x (cap_object cnode_cap, offset dest_root root_size)) s \<and> (\<forall>xa. reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> unat (?src_depth221 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> (cap_object (?cap232 x (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> one_lvl_lookup (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup x (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<mapsto>f CNode (empty_cnode (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa), offset (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap213 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R209 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'222 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz224 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s))
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object cnode_cap, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz224 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz'222 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object cnode_cap, offset dest_root root_size) ca)) : ?cap215 c (cap_object cnode_cap, offset dest_root root_size) ca ?src_index214 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object cnode_cap, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (7 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 2. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> one_lvl_lookup (?cap207 x (cap_object cnode_cap, offset dest_root root_size)) 32 root_size
 3. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> guard_equal (?cap207 x (cap_object cnode_cap, offset dest_root root_size)) src_root 32
 4. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> is_cnode_cap (?cap207 x (cap_object cnode_cap, offset dest_root root_size))
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 x (cap_object cnode_cap, offset dest_root root_size) \<and>* (cap_object (?cap207 x (cap_object cnode_cap, offset dest_root root_size)) \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object (?cap207 x (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) \<mapsto>c ?cap'206 x (cap_object cnode_cap, offset dest_root root_size)) \<and>* ?R205 x (cap_object cnode_cap, offset dest_root root_size)) s
 6. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> unat (?src_depth221 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> (cap_object (?cap232 x (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> one_lvl_lookup (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup x (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<mapsto>f CNode (empty_cnode (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa), offset (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap213 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R209 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'222 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz224 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s)
 7. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> (cap_object (?cap232 c (cap_object cnode_cap, offset dest_root root_size)), offset src_root root_size) = ?cap_ref230 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object cnode_cap, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz224 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz'222 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object cnode_cap, offset dest_root root_size) ca)) : ?cap215 c (cap_object cnode_cap, offset dest_root root_size) ca ?src_index214 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object cnode_cap, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap208 c (cap_object cnode_cap, offset dest_root root_size) \<and>* \<box> (root_size, word_bits) : ?cap207 c (cap_object cnode_cap, offset dest_root root_size) src_root \<mapsto>u ?cap'206 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap233 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap232 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object (?cap207 (fst r) (snd r)), offset src_root root_size)]
\<lambda>r. ?cap208 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap207 (fst r) (snd r)
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c ?cap'206 x (cap_object cnode_cap, offset dest_root root_size)) \<and>* ?R205 x (cap_object cnode_cap, offset dest_root root_size)) s
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> unat (?src_depth221 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> (cap_object cnode_cap, offset src_root root_size) = ?cap_ref230 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> one_lvl_lookup (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup x (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<mapsto>f CNode (empty_cnode (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa), offset (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap213 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R209 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'222 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz224 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s)
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> (cap_object cnode_cap, offset src_root root_size) = ?cap_ref230 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object cnode_cap, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz224 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz'222 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object cnode_cap, offset dest_root root_size) ca)) : ?cap215 c (cap_object cnode_cap, offset dest_root root_size) ca ?src_index214 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object cnode_cap, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u ?cap'206 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c ?cap'206 x (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 x (cap_object cnode_cap, offset dest_root root_size)) s
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> reset_cap_asid xa = reset_cap_asid (?cap'238 x (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> unat (?src_depth221 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> (cap_object cnode_cap, offset src_root root_size) = ?cap_ref230 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> one_lvl_lookup (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup x (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<mapsto>f CNode (empty_cnode (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa), offset (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap213 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R209 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'222 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz224 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s)
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid (?cap'238 c (cap_object cnode_cap, offset dest_root root_size)) \<longrightarrow> dest_index = ?dest_index237 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> (cap_object cnode_cap, offset src_root root_size) = ?cap_ref230 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object cnode_cap, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz224 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz'222 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object cnode_cap, offset dest_root root_size) ca)) : ?cap215 c (cap_object cnode_cap, offset dest_root root_size) ca ?src_index214 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object cnode_cap, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u ?cap'206 c (cap_object cnode_cap, offset dest_root root_size) \<and>* ?R205 c (cap_object cnode_cap, offset dest_root root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap'238 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r. ?cap'206 (fst r) (snd r)
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap\<rbrakk> \<Longrightarrow> reset_cap_asid xa = reset_cap_asid cnode_cap' \<longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> unat (?src_depth221 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> (cap_object cnode_cap, offset src_root root_size) = ?cap_ref230 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> one_lvl_lookup (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup x (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<mapsto>f CNode (empty_cnode (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa), offset (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap213 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R209 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'222 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz224 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s)
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> dest_index = ?dest_index237 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> (cap_object cnode_cap, offset src_root root_size) = ?cap_ref230 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object cnode_cap, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz224 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz'222 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object cnode_cap, offset dest_root root_size) ca)) : ?cap215 c (cap_object cnode_cap, offset dest_root root_size) ca ?src_index214 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object cnode_cap, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap x \<and> dest_depth = ?dest_depth236 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> dest_index = ?dest_index237 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_depth = ?src_depth234 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> src_index = ?src_index235 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap \<and> 0 < unat (?dest_depth218 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> 0 < unat (?src_depth220 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> unat (?dest_depth219 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> unat (?src_depth221 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32 \<and> (cap_object cnode_cap, offset src_root root_size) = ?cap_ref230 x (cap_object cnode_cap, offset dest_root root_size) xa \<and> one_lvl_lookup (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?src_depth216 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> one_lvl_lookup x (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and> guard_equal x (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat (?dest_depth211 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and> is_cnode_cap x \<and> cdl.lift ((cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) \<mapsto>f CNode (empty_cnode (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa), offset (?src_index214 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c ?src_cap213 x (cap_object cnode_cap, offset dest_root root_size) xa) \<and>* (cap_object x \<mapsto>f CNode (empty_cnode (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<and>* (cap_object x, offset (?dest_index210 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'212 x (cap_object cnode_cap, offset dest_root root_size) xa)) \<mapsto>c NullCap) \<and>* ?R209 x (cap_object cnode_cap, offset dest_root root_size) xa) s \<and> (\<forall>xb. reset_cap_asid xb = reset_cap_asid (?src_cap228 x (cap_object cnode_cap, offset dest_root root_size) xa) \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object (?cap226 x (cap_object cnode_cap, offset dest_root root_size) xa) = cap_object cnode_cap \<and> offset (?dest_index223 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz'222 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset dest_index dest_size \<and> offset (?src_index225 x (cap_object cnode_cap, offset dest_root root_size) xa) (?sz224 x (cap_object cnode_cap, offset dest_root root_size) xa) = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap227 x (cap_object cnode_cap, offset dest_root root_size) xa xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s)
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> dest_index = ?dest_index237 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> dest_depth = ?dest_depth236 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_index = ?src_index235 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> src_depth = ?src_depth234 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ca = ?cap231 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> (cap_object cnode_cap, offset src_root root_size) = ?cap_ref230 c (cap_object cnode_cap, offset dest_root root_size) ca \<and> ?src_cap229 c (cap_object cnode_cap, offset dest_root root_size) ca \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid (?src_cap228 c (cap_object cnode_cap, offset dest_root root_size) ca) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap227 c (cap_object cnode_cap, offset dest_root root_size) ca src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object (?cap226 c (cap_object cnode_cap, offset dest_root root_size) ca) = cap_object cnode_cap' \<and> offset (?src_index225 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz224 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset (?dest_index223 c (cap_object cnode_cap, offset dest_root root_size) ca) (?sz'222 c (cap_object cnode_cap, offset dest_root root_size) ca) = offset dest_index dest_size) \<and> unat (?src_depth221 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?src_depth220 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> unat (?dest_depth219 c (cap_object cnode_cap, offset dest_root root_size) ca) \<le> word_bits \<and> 0 < unat (?dest_depth218 c (cap_object cnode_cap, offset dest_root root_size) ca) \<and> cdl.lift (\<box> (?sz217 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?src_depth216 c (cap_object cnode_cap, offset dest_root root_size) ca)) : ?cap215 c (cap_object cnode_cap, offset dest_root root_size) ca ?src_index214 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u ?src_cap213 c (cap_object cnode_cap, offset dest_root root_size) ca \<and>* \<box> (?sz'212 c (cap_object cnode_cap, offset dest_root root_size) ca, unat (?dest_depth211 c (cap_object cnode_cap, offset dest_root root_size) ca)) : c ?dest_index210 c (cap_object cnode_cap, offset dest_root root_size) ca \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (21 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap x
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> dest_depth = ?dest_depth236 x (cap_object cnode_cap, offset dest_root root_size) xa
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> dest_index = ?dest_index237 x (cap_object cnode_cap, offset dest_root root_size) xa
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> src_depth = ?src_depth234 x (cap_object cnode_cap, offset dest_root root_size) xa
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> src_index = ?src_index235 x (cap_object cnode_cap, offset dest_root root_size) xa
 6. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa
 7. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap
 8. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> 0 < unat (?dest_depth218 x (cap_object cnode_cap, offset dest_root root_size) xa)
 9. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> 0 < unat (?src_depth220 x (cap_object cnode_cap, offset dest_root root_size) xa)
 10. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> unat (?dest_depth219 x (cap_object cnode_cap, offset dest_root root_size) xa) \<le> 32
A total of 21 subgoals...
flex-flex pairs:
\<lambda>r. ?dest_index237 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth236 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index235 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth234 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]), offset (?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]) (?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset (?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]) (?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index225 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_index223 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth221 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth220 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth219 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth218 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_depth216 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_index214 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_depth211 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_depth160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?dest_index210 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?dest_index160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (16 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> xa = ?cap231 x (cap_object cnode_cap, offset dest_root root_size) xa
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> ?src_cap229 x (cap_object cnode_cap, offset dest_root root_size) xa \<noteq> NullCap
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> 0 < unat dest_depth
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> 0 < unat src_depth
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> unat dest_depth \<le> 32
 6. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> unat src_depth \<le> 32
 7. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> (cap_object cnode_cap, offset src_root root_size) = ?cap_ref230 x (cap_object cnode_cap, offset dest_root root_size) xa
 8. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> one_lvl_lookup (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) (unat src_depth) (?sz217 x (cap_object cnode_cap, offset dest_root root_size) xa)
 9. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> guard_equal (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa) src_index (unat src_depth)
 10. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> is_cnode_cap (?cap215 x (cap_object cnode_cap, offset dest_root root_size) xa)
A total of 16 subgoals...
flex-flex pairs:
\<lambda>r. ?cap231 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap_ref230 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap_ref160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap229 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap228 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap227 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object (?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]), offset src_index (?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)])) (cap_object (fst r), offset dest_index (?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]))))
\<lambda>r. ?cap226 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz224 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'222 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz217 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?cap215 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?src_cap213 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?src_cap160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?sz'212 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?sz'160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; x = dest_root_cap; xa = cnode_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap) \<and>* (cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap) \<and>* ?R209 dest_root_cap (cap_object cnode_cap, offset dest_root root_size) cnode_cap') s
 2. \<And>s x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> reset_cap_asid xb = reset_cap_asid src_cap \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object cnode_cap' = cap_object cnode_cap \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap948 x (cap_object cnode_cap, offset dest_root root_size) xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> dest_index = dest_index \<and> dest_depth = dest_depth \<and> src_index = src_index \<and> src_depth = src_depth \<and> ca = cnode_cap' \<and> (cap_object cnode_cap, offset src_root root_size) = (cap_object cnode_cap, offset src_root root_size) \<and> src_cap \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap948 c (cap_object cnode_cap, offset dest_root root_size) src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object cnode_cap' = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> cdl.lift (\<box> (root_size, unat src_depth) : cnode_cap' src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap948 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object cnode_cap', offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* ?R209 dest_root_cap (cap_object cnode_cap, offset dest_root root_size) cnode_cap') s
 2. \<And>s x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> reset_cap_asid xb = reset_cap_asid src_cap \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object cnode_cap' = cap_object cnode_cap \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap948 x (cap_object cnode_cap, offset dest_root root_size) xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> dest_index = dest_index \<and> dest_depth = dest_depth \<and> src_index = src_index \<and> src_depth = src_depth \<and> ca = cnode_cap' \<and> (cap_object cnode_cap, offset src_root root_size) = (cap_object cnode_cap, offset src_root root_size) \<and> src_cap \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap948 c (cap_object cnode_cap, offset dest_root root_size) src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object cnode_cap' = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> cdl.lift (\<box> (root_size, unat src_depth) : cnode_cap' src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* ?R209 c (cap_object cnode_cap, offset dest_root root_size) ca) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap948 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object cnode_cap', offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>r. ?R209 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r c. ?R160 (fst r) (snd r) [(c, cap_object cnode_cap, offset src_root root_size)]
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'\<rbrakk> \<Longrightarrow> reset_cap_asid xb = reset_cap_asid src_cap \<longrightarrow> cap_object x = cap_object dest_root_cap \<and> reset_cap_asid xb = reset_cap_asid src_cap \<and> cap_object cnode_cap' = cap_object cnode_cap \<and> offset dest_index dest_size = offset dest_index dest_size \<and> offset src_index root_size = offset src_index root_size \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap948 x (cap_object cnode_cap, offset dest_root root_size) xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> dest_index = dest_index \<and> dest_depth = dest_depth \<and> src_index = src_index \<and> src_depth = src_depth \<and> ca = cnode_cap' \<and> (cap_object cnode_cap, offset src_root root_size) = (cap_object cnode_cap, offset src_root root_size) \<and> src_cap \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap948 c (cap_object cnode_cap, offset dest_root root_size) src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object cnode_cap' = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> cdl.lift (\<box> (root_size, unat src_depth) : cnode_cap' src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap948 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object cnode_cap', offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (2 subgoals):
 1. \<And>s x xa xb. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s; one_lvl_lookup cnode_cap 32 root_size; one_lvl_lookup cnode_cap' (unat src_depth) root_size; one_lvl_lookup dest_root_cap (unat dest_depth) dest_size; unat src_depth \<le> 32; 0 < unat src_depth; unat dest_depth \<le> 32; 0 < unat dest_depth; is_tcb tcb; is_cnode_cap dest_root_cap; is_cnode_cap cnode_cap; is_cnode_cap cnode_cap'; guard_equal cnode_cap' src_index (unat src_depth); guard_equal cnode_cap src_index (unat src_depth); guard_equal dest_root_cap dest_index (unat dest_depth); guard_equal cnode_cap src_root 32; guard_equal cnode_cap dest_root 32; cnode_id = cap_object cnode_cap; cap_object cnode_cap' = cap_object cnode_cap; dest_id = cap_object dest_root_cap; dest_root_slot = offset dest_root root_size; cnode_cap_slot = offset src_root root_size; src_slot = offset src_index root_size; src_cap \<noteq> NullCap; dest_slot = offset dest_index dest_size; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; reset_cap_asid x = reset_cap_asid dest_root_cap; reset_cap_asid xa = reset_cap_asid cnode_cap'; reset_cap_asid xb = reset_cap_asid src_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c ?cap948 x (cap_object cnode_cap, offset dest_root root_size) xb \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c NullCap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* R)) s
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> dest_index = dest_index \<and> dest_depth = dest_depth \<and> src_index = src_index \<and> src_depth = src_depth \<and> ca = cnode_cap' \<and> (cap_object cnode_cap, offset src_root root_size) = (cap_object cnode_cap, offset src_root root_size) \<and> src_cap \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c ?cap948 c (cap_object cnode_cap, offset dest_root root_size) src_cap' \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object cnode_cap' = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> cdl.lift (\<box> (root_size, unat src_depth) : cnode_cap' src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s
flex-flex pairs:
\<lambda>r. ?cap948 (fst r) (snd r) \<equiv>\<^sup>? \<lambda>r src_cap'. ?cap136 (InvokeCNode (MoveCall src_cap' (cap_object cnode_cap', offset src_index root_size) (cap_object (fst r), offset dest_index dest_size)))
\<lambda>dcap. ?cap136 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) \<equiv>\<^sup>? \<lambda>dcap. ?cap60 (InvokeCNode (MoveCall dcap (cap_object cnode_cap', offset src_index root_size) (cap_object dest_root_cap, offset dest_index dest_size))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> dest_index = dest_index \<and> dest_depth = dest_depth \<and> src_index = src_index \<and> src_depth = src_depth \<and> ca = cnode_cap' \<and> (cap_object cnode_cap, offset src_root root_size) = (cap_object cnode_cap, offset src_root root_size) \<and> src_cap \<noteq> NullCap \<and> (\<forall>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c src_cap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> reset_cap_asid src_cap' = reset_cap_asid src_cap \<and> cap_object cnode_cap' = cap_object cnode_cap' \<and> offset src_index root_size = offset src_index root_size \<and> cap_object c = cap_object dest_root_cap \<and> offset dest_index dest_size = offset dest_index dest_size) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> cdl.lift (\<box> (root_size, unat src_depth) : cnode_cap' src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> ca = cnode_cap' \<and> src_cap \<noteq> NullCap \<and> ((\<exists>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c src_cap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cap_object c = cap_object dest_root_cap) \<and> unat src_depth \<le> word_bits \<and> 0 < unat src_depth \<and> unat dest_depth \<le> word_bits \<and> 0 < unat dest_depth \<and> cdl.lift (\<box> (root_size, unat src_depth) : cnode_cap' src_index \<mapsto>u src_cap \<and>* \<box> (dest_size, unat dest_depth) : c dest_index \<mapsto>u NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> is_cnode_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap src_root \<mapsto>u cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap dest_root \<mapsto>u dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* \<box> (root_size, word_bits) : ?cap245 dest_root \<mapsto>u ?cap'245 \<and>* ?R245) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> ca = cnode_cap' \<and> src_cap \<noteq> NullCap \<and> ((\<exists>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c src_cap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cap_object c = cap_object dest_root_cap) \<and> unat src_depth \<le> 32 \<and> 0 < unat src_depth \<and> unat dest_depth \<le> 32 \<and> 0 < unat dest_depth \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> is_cnode_cap cnode_cap' \<and> one_lvl_lookup c (unat dest_depth) dest_size \<and> guard_equal c dest_index (unat dest_depth) \<and> is_cnode_cap c \<and> cdl.lift ((cap_object cnode_cap' \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c src_cap) \<and>* (cap_object c \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object c, offset dest_index dest_size) \<mapsto>c NullCap) \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> is_cnode_cap c) \<and> one_lvl_lookup cnode_cap 32 root_size \<and> guard_equal cnode_cap src_root 32 \<and> is_cnode_cap cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap') \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; guard_equal cnode_cap dest_root 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap) \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> one_lvl_lookup ?cap245 32 root_size \<and> guard_equal ?cap245 dest_root 32 \<and> is_cnode_cap ?cap245 \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* (cap_object ?cap245 \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object ?cap245, offset dest_root root_size) \<mapsto>c ?cap'245) \<and>* ?R245) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid dest_root_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cnode_cap' \<longrightarrow> ca = cnode_cap' \<and> src_cap \<noteq> NullCap \<and> ((\<exists>src_cap'. reset_cap_asid src_cap' = reset_cap_asid src_cap) \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c - \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c src_cap \<and>* ((cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c src_cap \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c NullCap \<longrightarrow>* root_tcb_id \<mapsto>f tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* dest_id \<mapsto>f CNode (empty_cnode dest_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, dest_root_slot) \<mapsto>c dest_root_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* (cnode_id, src_slot) \<mapsto>c NullCap \<and>* (dest_id, dest_slot) \<mapsto>c src_cap \<and>* R)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cap_object c = cap_object dest_root_cap) \<and> unat src_depth \<le> 32 \<and> 0 < unat src_depth \<and> unat dest_depth \<le> 32 \<and> 0 < unat dest_depth \<and> one_lvl_lookup cnode_cap' (unat src_depth) root_size \<and> guard_equal cnode_cap' src_index (unat src_depth) \<and> is_cnode_cap cnode_cap' \<and> one_lvl_lookup c (unat dest_depth) dest_size \<and> guard_equal c dest_index (unat dest_depth) \<and> is_cnode_cap c \<and> cdl.lift (cap_object cnode_cap' \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap', offset src_index root_size) \<mapsto>c src_cap \<and>* cap_object c \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object c, offset dest_index dest_size) \<mapsto>c NullCap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* R) s \<and> is_cnode_cap c) \<and> one_lvl_lookup cnode_cap 32 root_size \<and> guard_equal cnode_cap src_root 32 \<and> is_cnode_cap cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s \<and> \<not> ep_related_cap c; guard_equal cnode_cap dest_root 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset dest_root root_size) \<mapsto>c dest_root_cap \<and>* root_tcb_id \<mapsto>f tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cap_object dest_root_cap \<mapsto>f CNode (empty_cnode dest_size) \<and>* (cap_object cnode_cap, offset src_root root_size) \<mapsto>c cnode_cap' \<and>* (cap_object cnode_cap, offset src_index root_size) \<mapsto>c src_cap \<and>* (cap_object dest_root_cap, offset dest_index dest_size) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid ?cap'245 \<longrightarrow> \<not> ep_related_cap c) \<and> one_lvl_lookup ?cap245 32 root_size \<and> guard_equal ?cap245 dest_root 32 \<and> is_cnode_cap ?cap245 \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap245 \<and>* cap_object ?cap245 \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object ?cap245, offset dest_root root_size) \<mapsto>c ?cap'245 \<and>* ?R245) s proof (prove)
goal:
No subgoals!