theory Arch_DP

lemma seL4_Page_Table_Map:
  notes split_paired_Ex[simp del]
  assumes misc:
  "cap_object cnode_cap = cnode_id"
  "is_cnode_cap cnode_cap"
  "offset page_table root_size = pt_offset"
  "offset page_directory root_size = pd_offset"
  and sz: "one_lvl_lookup cnode_cap word_bits root_size"
          "guard_equal cnode_cap page_directory word_bits"
          "guard_equal cnode_cap page_table word_bits"
  shows "\<lbrace>
  \<guillemotleft> (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
  \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c -
  \<and>* (cnode_id, pt_offset) \<mapsto>c (PageTableCap ptr Real None)
  \<and>* (cnode_id, pd_offset) \<mapsto>c (PageDirectoryCap pd_ptr real_type None)
  \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap
  \<and>* root_tcb_id \<mapsto>f (Tcb tcb)
  \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size)
  \<and>*R \<guillemotright>\<rbrace>
  seL4_PageTable_Map page_table page_directory vaddr vmattribs
  \<lbrace>\<lambda>r s.
  \<guillemotleft> (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
  \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c (PageTableCap ptr Fake None)
  \<and>* (cnode_id, pt_offset) \<mapsto>c (PageTableCap ptr Real None)
  \<and>* (cnode_id, pd_offset) \<mapsto>c (PageDirectoryCap pd_ptr real_type None)
  \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap
  \<and>* root_tcb_id \<mapsto>f (Tcb tcb)
  \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size)
  \<and>*R \<guillemotright> s \<rbrace>" apply (simp add:seL4_PageTable_Map_def sep_state_projection2_def) apply (rule hoare_name_pre_state) apply (rule hoare_pre) apply (rule do_kernel_op_pull_back) apply (rule call_kernel_with_intent_allow_error_helper
     [where check = True and Perror = \<top>,simplified]) apply fastforce apply (rule set_cap_wp) apply (wp+)[4] apply (rule_tac P = "\<exists>asid'. iv = InvokePageTable (PageTableMap
            (PageTableCap ptr Real asid') (PageTableCap ptr Fake None)
            (cnode_id,pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))"
            in hoare_gen_asmEx) apply clarsimp apply wp apply (rule_tac P1 = "P1 \<and>* P2" for P1 P2 in hoare_strengthen_post
           [OF invoke_page_table_wp]) apply fastforce apply (rule conjI) apply (sep_solve) apply (subst sep_map_c_asid_reset [where ptr = "(cnode_id,pt_offset)"]) prefer 2 apply (sep_solve) apply (simp add:reset_cap_asid_def) apply (wp hoare_vcg_conj_lift) apply (wp hoare_strengthen_post[OF set_cap_wp]) apply (sep_solve ) apply wp apply (rule_tac P = "\<exists>asid asid'. (c = (PageTableCap ptr Real asid)
         \<and> cs = [(PageDirectoryCap pd_ptr real_type asid',(cnode_id,pd_offset))]
         \<and> ref = (cnode_id,pt_offset))"
         in hoare_gen_asmEx) apply (elim conjE exE) apply simp apply (rule_tac Q = "\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and>
                                    cdl_current_domain s = minBound \<and>
          <(root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
          \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap
          \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c -
          \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None
          \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None
          \<and>* root_tcb_id \<mapsto>f Tcb tcb
          \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*  R> s \<and>
         iv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None)
          (cnode_id,pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))"
         in hoare_post_impErr[rotated -1]) apply assumption apply clarsimp apply (rule hoare_vcg_E_elim) apply wp apply wp apply (rule validE_validE_R) apply (rule hoare_weaken_preE[where P = \<top>]) apply (wp decode_page_table_rv)[1] apply (simp add:cap_object_def) apply (simp add:cap_has_object_def) apply clarsimp apply (sep_solve) apply (simp add:lookup_extra_caps_def conj_comms mapME_singleton) apply (rule wp_no_exception_seq) apply wp apply (rule lookup_cap_and_slot_rvu[where r = root_size
       and cap' = "PageDirectoryCap pd_ptr real_type None"]) apply (rule hoare_pre) apply (wp lookup_cap_and_slot_rvu[where r = root_size
        and cap' = "PageTableCap ptr Real None"])[1] apply (erule_tac Q="cdl_current_domain sa = minBound" in conjE, assumption) apply (wp lookup_cap_and_slot_rvu[where r = root_size
       and cap' = "PageTableCap ptr Real None"])[1] apply clarsimp apply (wp update_thread_intent_update hoare_vcg_all_lift
      hoare_vcg_imp_lift) apply clarsimp defer apply clarsimp using misc sz apply (intro conjI impI allI, simp_all add: reset_cap_asid_simps2) apply (sep_solve) apply simp apply sep_solve apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def sep_conj_assoc) apply sep_solve apply (clarsimp dest!:reset_cap_asid_simps2 simp: ep_related_cap_def) apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def sep_conj_assoc) apply (sep_solve) apply (clarsimp dest!:reset_cap_asid_simps2 simp: ep_related_cap_def) apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def sep_conj_assoc) apply (sep_solve) apply (drule_tac x = "PageTableCap ptr Real None"  in spec) apply clarsimp apply (erule impE) apply (rule_tac x = "PageDirectoryCap pd_ptr real_type None" in exI) apply simp apply clarsimp apply (sep_solve) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>Separation_SD.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace> seL4_PageTable_Map page_table page_directory vaddr vmattribs \<lbrace>\<lambda>r. Separation_SD.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s)\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>(=) s\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Q2 s\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s)\<rbrace>
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> ?Q2 s sa proof (prove)
goal (2 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P5 s\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace>
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> ?P5 s (kernel_state sa) proof (prove)
goal (14 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op7 s) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr7 s \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> = ?intent_extra7 s
 2. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?R7 s\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ra7 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R7 s\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Rb7 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra7 s\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 7. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?PIV7 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb7 s sa\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op7 s) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.7 s sa\<rbrace>
 8. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV7 s iv\<rbrace>
 9. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (?intent_op7 s) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 10. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id (?intent_extra7 s) \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?R7 s\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace>
 2. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ra7 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R7 s\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Rb7 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra7 s\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 6. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?PIV7 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb7 s sa\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.7 s sa\<rbrace>
 7. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV7 s iv\<rbrace>
 8. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 10. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ra7 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace>
 2. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Rb7 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra7 s\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 5. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?PIV7 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb7 s sa\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.7 s sa\<rbrace>
 6. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV7 s iv\<rbrace>
 7. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 8. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 9. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?PIV7 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.7 s sa\<rbrace>
 2. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV7 s iv\<rbrace>
 3. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s iv. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> \<lbrace>?P'46 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.7 s sa\<rbrace>
 2. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'46 s iv and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 3. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'46 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace> invoke_page_table (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>
 2. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'46 s iv and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 3. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'57 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace> invoke_page_table (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>
 2. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> ?P'57 s iv a) and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 3. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s asid'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr) = PageTableMap (?real_pt_cap62 s asid') (?pt_cap62 s asid') (?pt_cap_ref73 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))) (?pt_target_slot72 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))))
 2. \<And>s asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift (?pt_cap_ref73 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))) \<mapsto>c ?real_pt_cap62 s asid' \<and>* ?pt_target_slot72 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))) \<mapsto>c ?pt_cap62 s asid' \<and>* ?P1.71 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))) \<and>* ?P2.70 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 3. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((?pt_cap_ref73 s iv) \<mapsto>c - \<and>* (?pt_target_slot72 s iv) \<mapsto>c - \<and>* ?P1.71 s iv \<and>* ?P2.70 s iv) a) and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 4. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 9. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real asid' \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* ?P1.71 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))) \<and>* ?P2.70 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 2. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* ?P1.71 s iv \<and>* ?P2.70 s iv) a) and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 3. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real asid' \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* ?P1.71 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))) \<and>* ?P2.70 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real asid' \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* ?P1.71 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))) \<and>* ?P2.70 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 3. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* ?P1.71 s iv \<and>* ?P2.70 s iv) a) and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 4. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 9. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real asid' \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.70 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 2. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.70 s iv) a) and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 3. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real asid' \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.70 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))) sa\<rbrakk> \<Longrightarrow> reset_cap_asid (PageTableCap ptr Real None) = reset_cap_asid (?cap'107 s asid' rv sa)
 2. \<And>s asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real asid' \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.70 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c ?cap'107 s asid' rv sa \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 3. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.70 s iv) a) and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 4. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 9. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real asid' \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.70 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (cnode_id, pt_offset) \<mapsto>c ?cap'107 s asid' rv sa \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 2. \<And>s asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real asid' \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.70 s (InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))) sa\<rbrakk> \<Longrightarrow> reset_cap_asid (PageTableCap ptr Real None) = reset_cap_asid (?cap'107 s asid' rv sa)
 3. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.70 s iv) a) and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 4. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 9. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real asid' \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c PageTableCap ptr Fake None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> reset_cap_asid (PageTableCap ptr Real None) = reset_cap_asid (PageTableCap ptr Real asid')
 2. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a) and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 3. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a) and K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 2. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'144 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift ((cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace>
 2. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'141 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 3. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> ?P'144 s iv sa) \<and> ?P'141 s iv sa\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s iv rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R149 s iv) sa\<rbrakk> \<Longrightarrow> cdl.lift ((cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 2. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'141 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 3. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R149 s iv) sa) \<and> ?P'141 s iv sa\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s iv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'141 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>
 2. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa) \<and> ?P'141 s iv sa\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) s) \<and> K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<exists>asid asid'. c = PageTableCap ptr Real asid \<and> cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> ref = (cnode_id, pt_offset)\<rbrakk> \<Longrightarrow> \<lbrace>?P'169 s c ref cs\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) s) \<and> K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?P'169 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs asid asid'. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset)\<rbrakk> \<Longrightarrow> \<lbrace>?P'169 s c ref cs\<rbrace> decode_invocation c ref cs (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) s) \<and> K (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?P'169 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs asid asid'. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset)\<rbrakk> \<Longrightarrow> \<lbrace>?P'169 s (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) s \<and> (\<exists>asid'. iv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?P'169 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s c ref cs asid asid' e sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); ?E174 s c ref cs asid asid' e sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s c ref cs asid asid'. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset)\<rbrakk> \<Longrightarrow> \<lbrace>?P'169 s (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s \<and> iv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrace>, \<lbrace>?E174 s c ref cs asid asid'\<rbrace>
 3. \<And>s c ref cs asid asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?P'169 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s c ref cs asid asid'. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset)\<rbrakk> \<Longrightarrow> \<lbrace>?P'169 s (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s \<and> iv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrace>, \<lbrace>\<lambda>e sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 2. \<And>s c ref cs asid asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))
 3. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?P'169 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s asid asid'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'169 s (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s \<and> iv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrace>, \<lbrace>\<lambda>e sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 2. \<And>s c ref cs asid asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))
 3. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. ?P'169 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid asid'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P186 s (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageTableIntent (PageTableMapIntent vaddr vmattribs)) -, \<lbrace>\<lambda>e sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 2. \<And>s asid asid'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'185 s (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s \<and> iv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrace>, -
 3. \<And>s c ref cs asid asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ?P186 s (fst r) (snd r) xa a \<and> ?P'185 s (fst r) (snd r) xa a) and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s asid asid'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'185 s (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s \<and> iv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrace>, -
 2. \<And>s c ref cs asid asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))
 3. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> ?P'185 s (fst r) (snd r) xa a) and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s asid asid'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'207 (PageDirectoryCap pd_ptr real_type asid') (PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset) s (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>rv s. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrace>, -
 2. \<And>s c ref cs asid asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))
 3. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> ?P'207 (fst (hd xa)) (hd xa) s (fst r) (snd r) xa a) and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s asid asid'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'207 (PageDirectoryCap pd_ptr real_type asid') (PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset) s (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>rv s. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s c ref cs asid asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))
 3. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> ?P'207 (fst (hd xa)) (hd xa) s (fst r) (snd r) xa a) and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid asid'. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Q213 s asid asid'\<rbrace> decode_invocation (PageTableCap ptr Real asid) (cnode_id, pt_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageTableIntent (PageTableMapIntent vaddr vmattribs)) \<lbrace>\<lambda>rv s. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s asid asid' sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); True\<rbrakk> \<Longrightarrow> ?Q213 s asid asid' sa
 3. \<And>s c ref cs asid asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))
 4. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s asid asid' sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); True\<rbrakk> \<Longrightarrow> True \<and> InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid (cap_asid (fst (PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset))) (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot (cap_object (fst (PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset))) vaddr)) = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))
 2. \<And>s c ref cs asid asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))
 3. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs asid asid' rv sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePageTable (PageTableMap (PageTableCap ptr Real asid') (PageTableCap ptr Fake None) (cnode_id, pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr)))
 2. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs asid asid' sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); c = PageTableCap ptr Real asid; cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]; ref = (cnode_id, pt_offset); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa
 2. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl_current_thread sa = Some root_tcb_id; cdl_current_domain sa = minBound; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, pt_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa
 2. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = PageTableCap ptr Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, pt_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 4. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id page_directory;
returnOk [x]
odE \<lbrace>\<lambda>xa s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> snd r = (cnode_id, pt_offset) \<and> (\<exists>asid. fst r = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> (\<exists>asid'. xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 4. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s r ra. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P'300 s r ra\<rbrace> returnOk [ra] \<lbrace>\<lambda>xa s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> snd r = (cnode_id, pt_offset) \<and> (\<exists>asid. fst r = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> (\<exists>asid'. xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id page_directory \<lbrace>?P'300 s r\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id page_directory \<lbrace>\<lambda>ra a. cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id \<and> snd r = (cnode_id, pt_offset) \<and> (\<exists>asid. fst r = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>asid'. [ra] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 4. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (4 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd r = (cnode_id, pt_offset) \<and> (\<exists>asid. fst r = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. [(c, cap_object (?cap314 s (fst r) (snd r)), offset page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s (fst r) (snd r) \<and>* \<box> (root_size, word_bits) : ?cap312 s (fst r) (snd r) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s (fst r) (snd r)) sa) \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 3. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 4. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap312 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap314 s (fst r) (snd r)
\<lambda>s r. ?cap312 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap313 s (fst r) (snd r) proof (prove)
goal (5 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?Q315 s\<rbrace> lookup_cap_and_slot root_tcb_id page_table \<lbrace>\<lambda>r sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd r = (cnode_id, pt_offset) \<and> (\<exists>asid. fst r = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. [(c, cap_object (?cap314 s (fst r) (snd r)), offset page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd r \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s (fst r) (snd r) \<and>* \<box> (root_size, word_bits) : ?cap312 s (fst r) (snd r) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s (fst r) (snd r)) sa) \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> ?Q315 s sa
 3. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 4. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap314 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r)
\<lambda>s r. ?cap313 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r) proof (prove)
goal (4 subgoals):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid (PageTableCap ptr Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap319 s), offset page_table root_size) = (cnode_id, pt_offset) \<and> (\<exists>asid. fst (c, cap_object (?cap319 s), offset page_table root_size) = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. [(ca, cap_object (?cap314 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))), offset page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd (c, cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) \<and>* \<box> (root_size, word_bits) : ?cap312 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap319 s), offset page_table root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa
 2. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 3. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 4. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap314 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r)
\<lambda>s r. ?cap313 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r) proof (prove)
goal (3 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid (PageTableCap ptr Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap319 s), offset page_table root_size) = (cnode_id, pt_offset) \<and> (\<exists>asid. fst (c, cap_object (?cap319 s), offset page_table root_size) = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. [(ca, cap_object (?cap314 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))), offset page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd (c, cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) \<and>* \<box> (root_size, word_bits) : ?cap312 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap319 s), offset page_table root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa) \<and> cdl_current_domain sa = minBound\<rbrace>
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ((\<forall>c. reset_cap_asid c = reset_cap_asid (PageTableCap ptr Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap319 s), offset page_table root_size) = (cnode_id, pt_offset) \<and> (\<exists>asid. fst (c, cap_object (?cap319 s), offset page_table root_size) = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. [(ca, cap_object (?cap314 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))), offset page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd (c, cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) \<and>* \<box> (root_size, word_bits) : ?cap312 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap319 s), offset page_table root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa) \<and> cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 3. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap314 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r)
\<lambda>s r. ?cap313 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r) proof (prove)
goal (3 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. (\<forall>c. reset_cap_asid c = reset_cap_asid (PageTableCap ptr Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap319 s), offset page_table root_size) = (cnode_id, pt_offset) \<and> (\<exists>asid. fst (c, cap_object (?cap319 s), offset page_table root_size) = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. [(ca, cap_object (?cap314 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))), offset page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd (c, cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) \<and>* \<box> (root_size, word_bits) : ?cap312 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap319 s), offset page_table root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa \<and> cdl_current_domain sa = minBound\<rbrace>
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ((\<forall>c. reset_cap_asid c = reset_cap_asid (PageTableCap ptr Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap319 s), offset page_table root_size) = (cnode_id, pt_offset) \<and> (\<exists>asid. fst (c, cap_object (?cap319 s), offset page_table root_size) = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. [(ca, cap_object (?cap314 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))), offset page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd (c, cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) \<and>* \<box> (root_size, word_bits) : ?cap312 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap319 s), offset page_table root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa) \<and> cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 3. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap314 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r)
\<lambda>s r. ?cap313 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r) proof (prove)
goal (3 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s) \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. (\<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> (\<forall>ca. reset_cap_asid ca = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> cap_object (?cap319 s) = cnode_id \<and> offset page_table root_size = pt_offset \<and> (\<exists>asid. c = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. ca = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap314 s c (cap_object (?cap319 s), offset page_table root_size)) = cnode_id \<and> offset page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s c (cap_object (?cap319 s), offset page_table root_size) \<and>* \<box> (root_size, word_bits) : ?cap312 s c (cap_object (?cap319 s), offset page_table root_size) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s c (cap_object (?cap319 s), offset page_table root_size)) sa \<and> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa \<and> cdl_current_domain sa = minBound\<rbrace>
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ((\<forall>c. reset_cap_asid c = reset_cap_asid (PageTableCap ptr Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap319 s), offset page_table root_size) = (cnode_id, pt_offset) \<and> (\<exists>asid. fst (c, cap_object (?cap319 s), offset page_table root_size) = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. [(ca, cap_object (?cap314 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))), offset page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd (c, cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) \<and>* \<box> (root_size, word_bits) : ?cap312 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap319 s), offset page_table root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa) \<and> cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 3. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap314 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r)
\<lambda>s r. ?cap313 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); ((\<forall>c. reset_cap_asid c = reset_cap_asid (PageTableCap ptr Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap319 s), offset page_table root_size) = (cnode_id, pt_offset) \<and> (\<exists>asid. fst (c, cap_object (?cap319 s), offset page_table root_size) = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. [(ca, cap_object (?cap314 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))), offset page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* snd (c, cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) \<and>* \<box> (root_size, word_bits) : ?cap312 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size)) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s (fst (c, cap_object (?cap319 s), offset page_table root_size)) (snd (c, cap_object (?cap319 s), offset page_table root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap319 s), offset page_table root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa) \<and> cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> PageTableCap ptr Real None \<or> (\<forall>xa. reset_cap_asid xa \<noteq> PageDirectoryCap pd_ptr real_type None \<or> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cap_object (?cap319 s) = cnode_id \<and> offset page_table root_size = pt_offset \<and> (\<exists>asid. x = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> (\<exists>asid'. xa = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap314 s x (cap_object (?cap319 s), offset page_table root_size)) = cnode_id \<and> offset page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s x (cap_object (?cap319 s), offset page_table root_size) \<and>* \<box> (root_size, word_bits) : ?cap312 s x (cap_object (?cap319 s), offset page_table root_size) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s x (cap_object (?cap319 s), offset page_table root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) (kernel_state sa) \<and> cdl_current_domain (kernel_state sa) = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap314 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r)
\<lambda>s r. ?cap313 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> (\<forall>ca. reset_cap_asid ca = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object (?cap319 s) = cnode_id \<and> offset page_table root_size = pt_offset \<and> (\<exists>asid. c = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. ca = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap314 s c (cap_object (?cap319 s), offset page_table root_size)) = cnode_id \<and> offset page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s c (cap_object (?cap319 s), offset page_table root_size) \<and>* \<box> (root_size, word_bits) : ?cap312 s c (cap_object (?cap319 s), offset page_table root_size) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s c (cap_object (?cap319 s), offset page_table root_size)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> PageTableCap ptr Real None \<or> (\<forall>xa. reset_cap_asid xa \<noteq> PageDirectoryCap pd_ptr real_type None \<or> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cap_object (?cap319 s) = cnode_id \<and> offset page_table root_size = pt_offset \<and> (\<exists>asid. x = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> (\<exists>asid'. xa = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap314 s x (cap_object (?cap319 s), offset page_table root_size)) = cnode_id \<and> offset page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s x (cap_object (?cap319 s), offset page_table root_size) \<and>* \<box> (root_size, word_bits) : ?cap312 s x (cap_object (?cap319 s), offset page_table root_size) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s x (cap_object (?cap319 s), offset page_table root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) (kernel_state sa) \<and> cdl_current_domain (kernel_state sa) = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap314 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r)
\<lambda>s r. ?cap313 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageTableIntent (PageTableMapIntent vaddr vmattribs)), cdl_intent_error = False, cdl_intent_cap = page_table, cdl_intent_extras = [page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> PageTableCap ptr Real None \<or> (\<forall>xa. reset_cap_asid xa \<noteq> PageDirectoryCap pd_ptr real_type None \<or> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cap_object (?cap319 s) = cnode_id \<and> offset page_table root_size = pt_offset \<and> (\<exists>asid. x = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> (\<exists>asid'. xa = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap314 s x (cap_object (?cap319 s), offset page_table root_size)) = cnode_id \<and> offset page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s x (cap_object (?cap319 s), offset page_table root_size) \<and>* \<box> (root_size, word_bits) : ?cap312 s x (cap_object (?cap319 s), offset page_table root_size) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s x (cap_object (?cap319 s), offset page_table root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) (kernel_state sa) \<and> cdl_current_domain (kernel_state sa) = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> (\<forall>ca. reset_cap_asid ca = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object (?cap319 s) = cnode_id \<and> offset page_table root_size = pt_offset \<and> (\<exists>asid. c = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. ca = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap314 s c (cap_object (?cap319 s), offset page_table root_size)) = cnode_id \<and> offset page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s c (cap_object (?cap319 s), offset page_table root_size) \<and>* \<box> (root_size, word_bits) : ?cap312 s c (cap_object (?cap319 s), offset page_table root_size) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s c (cap_object (?cap319 s), offset page_table root_size)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s r. ?cap314 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r)
\<lambda>s r. ?cap313 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r) proof (prove)
goal (2 subgoals):
 1. \<And>sa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa) \<Longrightarrow> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x = PageTableCap ptr Real None \<longrightarrow> (\<forall>xa. reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cap_object (?cap319 sa) = cnode_id \<and> offset page_table root_size = pt_offset \<and> (\<exists>asid. x = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> (\<exists>asid'. xa = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap314 sa x (cap_object (?cap319 sa), offset page_table root_size)) = cnode_id \<and> offset page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap319 sa), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 sa x (cap_object (?cap319 sa), offset page_table root_size) \<and>* \<box> (root_size, word_bits) : ?cap312 sa x (cap_object (?cap319 sa), offset page_table root_size) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 sa x (cap_object (?cap319 sa), offset page_table root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 sa \<and>* \<box> (root_size, word_bits) : ?cap319 sa page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 sa) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> (\<forall>ca. reset_cap_asid ca = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object (?cap319 s) = cnode_id \<and> offset page_table root_size = pt_offset \<and> (\<exists>asid. c = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. ca = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap314 s c (cap_object (?cap319 s), offset page_table root_size)) = cnode_id \<and> offset page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s c (cap_object (?cap319 s), offset page_table root_size) \<and>* \<box> (root_size, word_bits) : ?cap312 s c (cap_object (?cap319 s), offset page_table root_size) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s c (cap_object (?cap319 s), offset page_table root_size)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s r. ?cap314 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r)
\<lambda>s r. ?cap313 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r) proof (prove)
using this:
cap_object cnode_cap = cnode_id
is_cnode_cap cnode_cap
offset page_table root_size = pt_offset
offset page_directory root_size = pd_offset
one_lvl_lookup cnode_cap word_bits root_size
guard_equal cnode_cap page_directory word_bits
guard_equal cnode_cap page_table word_bits

goal (2 subgoals):
 1. \<And>sa. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa) \<Longrightarrow> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x = PageTableCap ptr Real None \<longrightarrow> (\<forall>xa. reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cap_object (?cap319 sa) = cnode_id \<and> offset page_table root_size = pt_offset \<and> (\<exists>asid. x = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> (\<exists>asid'. xa = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap314 sa x (cap_object (?cap319 sa), offset page_table root_size)) = cnode_id \<and> offset page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap319 sa), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 sa x (cap_object (?cap319 sa), offset page_table root_size) \<and>* \<box> (root_size, word_bits) : ?cap312 sa x (cap_object (?cap319 sa), offset page_table root_size) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 sa x (cap_object (?cap319 sa), offset page_table root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 sa \<and>* \<box> (root_size, word_bits) : ?cap319 sa page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 sa) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> (\<forall>ca. reset_cap_asid ca = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object (?cap319 s) = cnode_id \<and> offset page_table root_size = pt_offset \<and> (\<exists>asid. c = PageTableCap ptr Real asid) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid'. ca = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap314 s c (cap_object (?cap319 s), offset page_table root_size)) = cnode_id \<and> offset page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap319 s), offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap313 s c (cap_object (?cap319 s), offset page_table root_size) \<and>* \<box> (root_size, word_bits) : ?cap312 s c (cap_object (?cap319 s), offset page_table root_size) page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s c (cap_object (?cap319 s), offset page_table root_size)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap319 s \<and>* \<box> (root_size, word_bits) : ?cap319 s page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s r. ?cap314 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r)
\<lambda>s r. ?cap313 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap312 s (fst r) (snd r) proof (prove)
goal (7 subgoals):
 1. \<And>sa x xa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>sa x xa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)
 3. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 sa x (cap_object cnode_cap, pt_offset)) (kernel_state sa)
 4. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 5. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 sa) (kernel_state sa)
 6. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 7. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s c (cap_object cnode_cap, pt_offset)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (6 subgoals):
 1. \<And>sa x xa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)
 2. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 sa x (cap_object cnode_cap, pt_offset)) (kernel_state sa)
 3. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 4. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 sa) (kernel_state sa)
 5. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s c (cap_object cnode_cap, pt_offset)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (6 subgoals):
 1. \<And>sa x xa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)
 2. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 sa x (cap_object cnode_cap, pt_offset)) (kernel_state sa)
 3. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 4. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 sa) (kernel_state sa)
 5. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 6. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s c (cap_object cnode_cap, pt_offset)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 sa x (cap_object cnode_cap, pt_offset)) (kernel_state sa)
 2. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 3. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 sa) (kernel_state sa)
 4. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s c (cap_object cnode_cap, pt_offset)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); reset_cap_asid x = PageTableCap ptr Real None; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap page_directory 32; guard_equal cnode_cap page_table 32; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size; cdl_current_thread (kernel_state sa) = Some root_tcb_id; cdl_current_domain (kernel_state sa) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* ?R311 sa x (cap_object cnode_cap, offset page_table root_size)) (kernel_state sa)
 2. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 3. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 sa) (kernel_state sa)
 4. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 5. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R311 s c (cap_object cnode_cap, pt_offset)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (4 subgoals):
 1. \<And>sa x. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = PageTableCap ptr Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 2. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 sa) (kernel_state sa)
 3. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 4. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 sa) (kernel_state sa)
 2. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 3. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap page_directory 32; guard_equal cnode_cap page_table 32; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size; cdl_current_thread (kernel_state sa) = Some root_tcb_id; cdl_current_domain (kernel_state sa) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* ?R319 sa) (kernel_state sa)
 2. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 3. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* ?R319 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa); is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap page_directory 32; guard_equal cnode_cap page_table 32; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset page_table root_size = pt_offset; offset page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits; reset_cap_asid (PageTableCap ptr Real None) = PageTableCap ptr Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, pt_offset) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa \<and> \<not> ep_related_cap (PageTableCap ptr Real None)\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size; (\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; \<not> ep_related_cap (PageTableCap ptr Real None)\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; \<not> ep_related_cap (PageTableCap ptr Real None)\<rbrakk> \<Longrightarrow> \<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; \<not> ep_related_cap (PageTableCap ptr Real None); cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; \<not> ep_related_cap (PageTableCap ptr Real None)\<rbrakk> \<Longrightarrow> reset_cap_asid (PageDirectoryCap pd_ptr real_type None) = PageDirectoryCap pd_ptr real_type None
 2. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; \<not> ep_related_cap (PageTableCap ptr Real None); cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; \<not> ep_related_cap (PageTableCap ptr Real None); cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_table \<mapsto>u PageTableCap ptr Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap page_directory word_bits; guard_equal cnode_cap page_table word_bits; cnode_id = cap_object cnode_cap; pt_offset = offset page_table root_size; pd_offset = offset page_directory root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* R) sa; \<not> ep_related_cap (PageTableCap ptr Real None); cdl_current_thread sa = Some root_tcb_id; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset page_table root_size) \<mapsto>c PageTableCap ptr Real None \<and>* (cap_object cnode_cap, offset page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal:
No subgoals!