theory IRQ_DP

lemma seL4_IRQHandler_IRQControl_Get_helper:
 assumes unify : "irq_cap = IrqHandlerCap irq \<and>
                  target_index = offset node_index root_size \<and>
                  root_index = offset croot root_size \<and>
                  control_index = offset control_cap root_size \<and>
                  target_ptr = (cap_object root_cap, target_index) \<and>
                  control_ptr = (cap_object root_cap, control_index) \<and>
                  root_ptr = (cap_object root_cap, root_index) \<and>
                  root_tcb  = Tcb t"
shows "\<lbrace>\<guillemotleft>root_tcb_id \<mapsto>f root_tcb  \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>*
         cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>*
         (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>*
          control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R  \<guillemotright>
              and K ( \<not> ep_related_cap c_cap  \<and> one_lvl_lookup root_cap word_bits root_size \<and>
              one_lvl_lookup root_cap (unat node_depth) root_size \<and>
              guard_equal root_cap node_index (unat node_depth) \<and>
              guard_equal root_cap croot word_bits  \<and>
              guard_equal root_cap control_cap word_bits \<and>
              guard_equal root_cap node_index word_bits \<and>
              unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and>
              is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap \<and> is_cnode_cap root_cap)\<rbrace>
        seL4_IRQControl_Get control_cap irq croot node_index node_depth
        \<lbrace>\<lambda>fail s. \<guillemotleft> root_tcb_id \<mapsto>f root_tcb \<and>*
       (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*
       \<comment> \<open>Root CNode.\<close>
       cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>*
       \<comment> \<open>Cap to the root CNode.\<close>
       (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>*
       irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R\<guillemotright> s\<rbrace>" apply (simp add: seL4_IRQControl_Get_def sep_state_projection2_def) apply (rule hoare_pre) apply (wp do_kernel_op_pull_back) apply (rule call_kernel_with_intent_allow_error_helper
                [where check = True and Perror = \<top> and intent_op = "(IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth))" and tcb = t and intent_cptr = control_cap and intent_extra = "[croot]" ,simplified]) apply (clarsimp) apply (rule set_cap_wp[sep_wand_wp]) apply (rule mark_tcb_intent_error_sep_inv) apply (wp (once)) apply (rule corrupt_ipc_buffer_sep_inv) apply (wp (once)) apply (rule_tac P = "(iv = (InvokeIrqControl $ (IssueIrqHandler irq control_ptr (cap_object root_cap, offset node_index root_size))))" in  hoare_gen_asmEx) apply (clarsimp simp: unify) apply (wp invoke_irq_control_issue_handler_wp[sep_wand_wp]) apply (wp set_cap_wp[sep_wand_wp]) apply (rule_tac P = "c=IrqControlCap" in hoare_gen_asmEx, simp) apply (simp add:  decode_invocation_def, wp) apply (rule_tac P = "irq_control_intent=IrqControlIssueIrqHandlerIntent irq node_index node_depth" in hoare_gen_asmE, simp) apply (wp decode_irq_control_issue_irq_rv[where root_cap=root_cap and root_ptr=root_ptr and xs ="[]" and r = root_size, simplified ]) apply (simp) apply (unfold throw_opt_def get_irq_control_intent_def, simp) apply (rule returnOk_wp) apply (rule lookup_extra_caps_once_wp[where cap'=root_cap and r=root_size, simplified user_pointer_at_def]) apply (rule lookup_cap_and_slot_rvu[where cap'=c_cap and r=root_size, simplified user_pointer_at_def]) apply (wp  hoare_vcg_imp_lift hoare_vcg_all_lift
          update_thread_intent_update) apply (clarsimp) apply (rule conjI) apply (erule allE impE)+ apply fastforce apply (erule conjE allE impE)+ apply (fastforce) apply (clarsimp) apply (rule conjI) apply (erule allE impE)+ apply fastforce apply (erule conjE allE impE)+ apply (fastforce) apply (clarsimp) apply (sep_solve) apply (intro impI conjI allI) apply (clarsimp) apply (clarsimp) apply (intro impI conjI allI) apply (sep_solve) apply (clarsimp simp: unify) apply (sep_cancel)+ apply (intro impI conjI allI) apply sep_solve apply (clarsimp simp: unify) apply sep_solve apply (clarsimp simp: unify) apply fastforce apply (clarsimp simp: unify) apply (metis is_cnode_cap_not_memory_cap not_memory_cap_reset_asid') apply (clarsimp simp: unify) apply fastforce apply (clarsimp simp: user_pointer_at_def Let_unfold sep_conj_assoc unify) apply sep_solve apply (drule reset_cap_asid_control, assumption, clarsimp simp: is_irqcontrol_cap_def) apply (clarsimp simp: user_pointer_at_def Let_unfold sep_conj_assoc unify) apply sep_solve apply (clarsimp simp: unify) apply (drule reset_cap_asid_ep_related_cap) apply clarsimp apply (clarsimp simp: user_pointer_at_def Let_unfold sep_conj_assoc unify) apply sep_solve apply (clarsimp simp: unify) apply sep_solve done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) and K (\<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap \<and> is_cnode_cap root_cap)\<rbrace> seL4_IRQControl_Get control_cap irq croot node_index node_depth \<lbrace>\<lambda>fail. Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>fail s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>fail s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)\<rbrace>
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> ?Q s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P4\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>fail. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R)\<rbrace>
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> ?P4 (kernel_state s) proof (prove)
goal (14 subgoals):
 1. cdl_intent_op \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = control_cap \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = [croot]
 2. \<lbrace>?R6\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>fail. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R)\<rbrace>
 3. \<lbrace>?Ra6\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>fail. ?R6\<rbrace>
 4. \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 5. \<lbrace>?Rb6\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail. ?Ra6\<rbrace>
 6. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 7. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb6 s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 8. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 9. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 10. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<lbrace>?R6\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>fail. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R)\<rbrace>
 2. \<lbrace>?Ra6\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>fail. ?R6\<rbrace>
 3. \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 4. \<lbrace>?Rb6\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail. ?Ra6\<rbrace>
 5. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 6. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb6 s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 7. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 8. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 10. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrace>?Ra6\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>fail. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R))\<rbrace>
 2. \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 3. \<lbrace>?Rb6\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail. ?Ra6\<rbrace>
 4. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 5. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb6 s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 6. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 7. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 8. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 9. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 2. \<lbrace>?Rb6\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R))\<rbrace>
 3. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 4. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb6 s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 5. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 6. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 7. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 8. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 10. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<lbrace>?Rb6\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R))\<rbrace>
 2. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 3. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb6 s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 4. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 7. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 9. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 10. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (9 subgoals):
 1. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 2. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 3. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 6. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 8. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 9. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 5. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 7. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 8. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>iv. iv = (InvokeIrqControl $ IssueIrqHandler irq control_ptr (cap_object root_cap, offset node_index root_size)) \<Longrightarrow> \<lbrace>?P'32 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c irq_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?P'32 iv and K (iv = (InvokeIrqControl $ IssueIrqHandler irq control_ptr (cap_object root_cap, offset node_index root_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 5. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 7. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 8. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<lbrace>?P'32 (InvokeIrqControl (IssueIrqHandler irq (cap_object root_cap, offset control_cap root_size) (cap_object root_cap, offset node_index root_size)))\<rbrace> invoke_irq_control (IssueIrqHandler irq (cap_object root_cap, offset control_cap root_size) (cap_object root_cap, offset node_index root_size)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?P'32 iv and K (iv = (InvokeIrqControl $ IssueIrqHandler irq control_ptr (cap_object root_cap, offset node_index root_size)))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 5. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 7. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 8. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap46 iv \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a))) a) and K (iv = (InvokeIrqControl $ IssueIrqHandler irq control_ptr (cap_object root_cap, offset node_index root_size)))\<rbrace>
 2. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 4. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 6. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 7. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap46 iv \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> K (iv = (InvokeIrqControl $ IssueIrqHandler irq control_ptr (cap_object root_cap, offset node_index root_size))) s\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 3. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 5. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. c = IrqControlCap \<Longrightarrow> \<lbrace>?P'63 IrqControlCap ref cs\<rbrace> decode_invocation IrqControlCap ref cs (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap46 iv \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> iv = InvokeIrqControl (IssueIrqHandler irq control_ptr (cap_object root_cap, offset node_index root_size))\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?P'63 (fst fail) (snd fail) xa and K (fst fail = IrqControlCap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 3. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 5. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>c ref cs irq_control_intent. c = IrqControlCap \<Longrightarrow> \<lbrace>?P'72 c ref cs irq_control_intent\<rbrace> decode_irq_control_invocation IrqControlCap ref cs irq_control_intent \<lbrace>(\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap46 iv \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> iv = InvokeIrqControl (IssueIrqHandler irq control_ptr (cap_object root_cap, offset node_index root_size))) \<circ> InvokeIrqControl\<rbrace>, -
 2. \<And>c ref cs. c = IrqControlCap \<Longrightarrow> \<lbrace>?P'63 (ds_id IrqControlCap) ref cs\<rbrace> throw_opt undefined (get_irq_control_intent (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth))) \<lbrace>\<lambda>irq_control_intent s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> ?P'72 c ref cs irq_control_intent s\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?P'63 (fst fail) (snd fail) xa and K (fst fail = IrqControlCap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 4. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 6. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 7. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>c ref cs irq_control_intent. \<lbrakk>c = IrqControlCap; irq_control_intent = IrqControlIssueIrqHandlerIntent irq node_index node_depth\<rbrakk> \<Longrightarrow> \<lbrace>?P'75 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)\<rbrace> decode_irq_control_invocation IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<lbrace>(\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap46 iv \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> iv = InvokeIrqControl (IssueIrqHandler irq control_ptr (cap_object root_cap, offset node_index root_size))) \<circ> InvokeIrqControl\<rbrace>, -
 2. \<And>c ref cs. c = IrqControlCap \<Longrightarrow> \<lbrace>?P'63 (ds_id IrqControlCap) ref cs\<rbrace> throw_opt undefined (get_irq_control_intent (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth))) \<lbrace>\<lambda>irq_control_intent s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> (?P'75 c ref cs irq_control_intent and K (irq_control_intent = IrqControlIssueIrqHandlerIntent irq node_index node_depth)) s\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?P'63 (fst fail) (snd fail) xa and K (fst fail = IrqControlCap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 4. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 6. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 7. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. c = IrqControlCap \<Longrightarrow> \<lbrace>?P'63 (ds_id IrqControlCap) ref cs\<rbrace> throw_opt undefined (get_irq_control_intent (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth))) \<lbrace>\<lambda>irq_control_intent s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> ((\<lambda>a. ((\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap85 c irq_control_intent iv \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> iv = InvokeIrqControl (IssueIrqHandler irq control_ptr (cap_object root_cap, offset node_index root_size))) \<circ> InvokeIrqControl) (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)) a \<and> cs = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap83 c ref cs irq_control_intent \<and>* ?R81 c ref cs irq_control_intent) a) and K (irq_control_intent = IrqControlIssueIrqHandlerIntent irq node_index node_depth)) s\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?P'63 (fst fail) (snd fail) xa and K (fst fail = IrqControlCap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 3. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 5. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. c = IrqControlCap \<Longrightarrow> \<lbrace>?P'63 (ds_id IrqControlCap) ref cs\<rbrace> throw_opt undefined (get_irq_control_intent (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth))) \<lbrace>\<lambda>irq_control_intent s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap85 IrqControlCap irq_control_intent (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size))) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> ref = control_ptr \<and> cs = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap83 IrqControlCap ref cs irq_control_intent \<and>* ?R81 IrqControlCap ref cs irq_control_intent) s \<and> irq_control_intent = IrqControlIssueIrqHandlerIntent irq node_index node_depth\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?P'63 (fst fail) (snd fail) xa and K (fst fail = IrqControlCap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 3. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 5. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. c = IrqControlCap \<Longrightarrow> \<lbrace>?P'63 (ds_id IrqControlCap) ref cs\<rbrace> returnOk (IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<lbrace>\<lambda>irq_control_intent s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap85 IrqControlCap irq_control_intent (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size))) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> ref = control_ptr \<and> cs = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap83 IrqControlCap ref cs irq_control_intent \<and>* ?R81 IrqControlCap ref cs irq_control_intent) s \<and> irq_control_intent = IrqControlIssueIrqHandlerIntent irq node_index node_depth\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?P'63 (fst fail) (snd fail) xa and K (fst fail = IrqControlCap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 3. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 5. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap94 (fst fail) (snd fail) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) a \<and> snd fail = control_ptr \<and> xa = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap93 (fst fail) (snd fail) xa \<and>* ?R92 (fst fail) (snd fail) xa) a \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) and K (fst fail = IrqControlCap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 2. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 4. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 5. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (4 subgoals):
 1. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id control_cap \<lbrace>\<lambda>fail s. ((\<forall>c. reset_cap_asid c = reset_cap_asid root_cap \<longrightarrow> ((\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst fail) (snd fail) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) a \<and> snd fail = control_ptr \<and> [(c, cap_object (?cap114 (fst fail) (snd fail)), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst fail) (snd fail) c \<and>* ?R112 (fst fail) (snd fail) c) a \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) and K (fst fail = IrqControlCap)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst fail) (snd fail) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst fail) (snd fail)) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst fail) (snd fail)) remaining_size sz \<and> guard_equal (?cap108 (fst fail) (snd fail)) croot remaining_size \<and> is_cnode_cap (?cap107 (fst fail) (snd fail))) \<and>* ?R106 (fst fail) (snd fail)) s) \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 3. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap107 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap114 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap107 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap111 (fst fail) (snd fail)
\<lambda>fail. ?cap107 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap110 (fst fail) (snd fail)
\<lambda>fail. ?cap107 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap109 (fst fail) (snd fail)
\<lambda>fail. ?cap107 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap108 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (3 subgoals):
 1. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> ((\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) a \<and> snd (c, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(ca, cap_object (?cap114 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) ca \<and>* ?R112 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) ca) a \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) and K (fst (c, cap_object ?cap116, offset control_cap root_size) = IrqControlCap)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; ca = cap_object (?cap110 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) in (ca \<mapsto>f CNode (empty_cnode sz) \<and>* (ca, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let (sz, remaining_size) = (root_size, word_bits); slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrace>
 2. \<And>s. (\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> ((\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) a \<and> snd (c, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(ca, cap_object (?cap114 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) ca \<and>* ?R112 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) ca) a \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) and K (fst (c, cap_object ?cap116, offset control_cap root_size) = IrqControlCap)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; ca = cap_object (?cap110 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) in (ca \<mapsto>f CNode (empty_cnode sz) \<and>* (ca, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let (sz, remaining_size) = (root_size, word_bits); slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (2 subgoals):
 1. \<And>s. (\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> ((\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) a \<and> snd (c, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(ca, cap_object (?cap114 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) ca \<and>* ?R112 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) ca) a \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) and K (fst (c, cap_object ?cap116, offset control_cap root_size) = IrqControlCap)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; ca = cap_object (?cap110 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) in (ca \<mapsto>f CNode (empty_cnode sz) \<and>* (ca, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (c, cap_object ?cap116, offset control_cap root_size)) (snd (c, cap_object ?cap116, offset control_cap root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let (sz, remaining_size) = (root_size, word_bits); slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (4 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s \<Longrightarrow> reset_cap_asid (?c243 s) = reset_cap_asid c_cap
 2. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s; (\<forall>c. reset_cap_asid c = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (?c243 s) (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> c = root_cap \<and> (cap_object (?cap114 (?c243 s) (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (?c243 s) (cap_object ?cap116, offset control_cap root_size) c \<and>* ?R112 (?c243 s) (cap_object ?cap116, offset control_cap root_size) c) s \<and> ?c243 s = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (?c243 s) (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>sa. let c = cap_object (?cap110 (?c243 s) (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) sa \<and> one_lvl_lookup (?cap109 (?c243 s) (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 (?c243 s) (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 (?c243 s) (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 (?c243 s) (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap (?c243 s)\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s; (\<forall>c. reset_cap_asid c = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> c = root_cap \<and> (cap_object (?cap114 c_cap (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c_cap (cap_object ?cap116, offset control_cap root_size) c \<and>* ?R112 c_cap (cap_object ?cap116, offset control_cap root_size) c) s \<and> c_cap = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 c_cap (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c_cap (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c_cap (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c_cap (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c_cap (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c_cap\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 c_cap (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c_cap (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c_cap (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c_cap (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c_cap (cap_object ?cap116, offset control_cap root_size)) s; \<not> ep_related_cap c_cap\<rbrakk> \<Longrightarrow> reset_cap_asid (?c255 s) = reset_cap_asid root_cap
 2. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 c_cap (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c_cap (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c_cap (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c_cap (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c_cap (cap_object ?cap116, offset control_cap root_size)) s; \<not> ep_related_cap c_cap; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ?c255 s = root_cap \<and> (cap_object (?cap114 c_cap (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c_cap (cap_object ?cap116, offset control_cap root_size) (?c255 s) \<and>* ?R112 c_cap (cap_object ?cap116, offset control_cap root_size) (?c255 s)) s \<and> c_cap = IrqControlCap\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 c_cap (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c_cap (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c_cap (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c_cap (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c_cap (cap_object ?cap116, offset control_cap root_size)) s; \<not> ep_related_cap c_cap; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> root_cap = root_cap \<and> (cap_object (?cap114 c_cap (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c_cap (cap_object ?cap116, offset control_cap root_size) root_cap \<and>* ?R112 c_cap (cap_object ?cap116, offset control_cap root_size) root_cap) s \<and> c_cap = IrqControlCap\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (4 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s \<Longrightarrow> reset_cap_asid (?c269 s) = reset_cap_asid c_cap
 2. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s; (\<forall>c. reset_cap_asid c = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (?c269 s) (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> c = root_cap \<and> (cap_object (?cap114 (?c269 s) (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (?c269 s) (cap_object ?cap116, offset control_cap root_size) c \<and>* ?R112 (?c269 s) (cap_object ?cap116, offset control_cap root_size) c) s \<and> ?c269 s = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (?c269 s) (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>sa. let c = cap_object (?cap110 (?c269 s) (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) sa \<and> one_lvl_lookup (?cap109 (?c269 s) (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 (?c269 s) (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 (?c269 s) (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 (?c269 s) (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap (?c269 s)\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s; (\<forall>c. reset_cap_asid c = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> c = root_cap \<and> (cap_object (?cap114 c_cap (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c_cap (cap_object ?cap116, offset control_cap root_size) c \<and>* ?R112 c_cap (cap_object ?cap116, offset control_cap root_size) c) s \<and> c_cap = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 c_cap (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c_cap (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c_cap (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c_cap (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c_cap (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c_cap\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 c_cap (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c_cap (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c_cap (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c_cap (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c_cap (cap_object ?cap116, offset control_cap root_size)) s; \<not> ep_related_cap c_cap\<rbrakk> \<Longrightarrow> reset_cap_asid (?c281 s) = reset_cap_asid root_cap
 2. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 c_cap (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c_cap (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c_cap (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c_cap (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c_cap (cap_object ?cap116, offset control_cap root_size)) s; \<not> ep_related_cap c_cap; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ?c281 s = root_cap \<and> (cap_object (?cap114 c_cap (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c_cap (cap_object ?cap116, offset control_cap root_size) (?c281 s) \<and>* ?R112 c_cap (cap_object ?cap116, offset control_cap root_size) (?c281 s)) s \<and> c_cap = IrqControlCap\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 c_cap (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c_cap (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c_cap (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c_cap (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c_cap (cap_object ?cap116, offset control_cap root_size)) s; \<not> ep_related_cap c_cap; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c_cap (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> root_cap = root_cap \<and> (cap_object (?cap114 c_cap (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c_cap (cap_object ?cap116, offset control_cap root_size) root_cap \<and>* ?R112 c_cap (cap_object ?cap116, offset control_cap root_size) root_cap) s \<and> c_cap = IrqControlCap\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid c_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 c (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) s \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> ca = root_cap \<and> (cap_object (?cap114 c (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 c (cap_object ?cap116, offset control_cap root_size) ca \<and>* ?R112 c (cap_object ?cap116, offset control_cap root_size) ca) s \<and> c = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 c (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let ca = cap_object (?cap110 c (cap_object ?cap116, offset control_cap root_size)) in (ca \<mapsto>f CNode (empty_cnode root_size) \<and>* (ca, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 c (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 c (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 c (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 c (cap_object ?cap116, offset control_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<and>* ?R116) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ?R116) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (1 subgoal):
 1. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (4 subgoals):
 1. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent irq node_index node_depth)), cdl_intent_error = False, cdl_intent_cap = control_cap, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>
 2. \<And>s x. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))
 3. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (3 subgoals):
 1. \<And>s x. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> reset_cap_asid x \<noteq> reset_cap_asid c_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> snd (x, cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> [(xa, cap_object (?cap114 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))), offset croot root_size)] = [(root_cap, root_ptr)] \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa \<and>* ?R112 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) xa) (kernel_state s) \<and> IrqControlIssueIrqHandlerIntent irq node_index node_depth = IrqControlIssueIrqHandlerIntent irq node_index node_depth) \<and> K (fst (x, cap_object ?cap116, offset control_cap root_size) = IrqControlCap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)) \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset croot sz; c = cap_object (?cap110 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) remaining_size sz \<and> guard_equal (?cap108 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) croot remaining_size \<and> is_cnode_cap (?cap107 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size)))) \<and>* ?R106 (fst (x, cap_object ?cap116, offset control_cap root_size)) (snd (x, cap_object ?cap116, offset control_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap116, offset control_cap root_size))
 2. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (3 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> (\<forall>xa. reset_cap_asid xa = reset_cap_asid root_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 x (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s) \<and> (cap_object ?cap116, offset control_cap root_size) = control_ptr \<and> xa = root_cap \<and> (cap_object (?cap114 x (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr \<and> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object ?cap116, offset control_cap root_size) xa \<and>* ?R112 x (cap_object ?cap116, offset control_cap root_size) xa) (kernel_state s) \<and> x = IrqControlCap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 x (cap_object ?cap116, offset control_cap root_size)) (kernel_state s) \<and> \<not> ep_related_cap x
 2. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (11 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s)
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 x (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s)
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object ?cap116, offset control_cap root_size) = control_ptr
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr
 6. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object ?cap116, offset control_cap root_size) xa \<and>* ?R112 x (cap_object ?cap116, offset control_cap root_size) xa) (kernel_state s)
 7. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 8. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 x (cap_object ?cap116, offset control_cap root_size)) (kernel_state s)
 9. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 10. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (10 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 x (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s)
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object ?cap116, offset control_cap root_size) = control_ptr
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object ?cap116, offset control_cap root_size) xa \<and>* ?R112 x (cap_object ?cap116, offset control_cap root_size) xa) (kernel_state s)
 6. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 x (cap_object ?cap116, offset control_cap root_size)) (kernel_state s)
 8. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 9. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 10. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (10 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c target_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap115 x (cap_object ?cap116, offset control_cap root_size) \<and>* ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) a)))) (kernel_state s)
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object ?cap116, offset control_cap root_size) = control_ptr
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object ?cap116, offset control_cap root_size) xa \<and>* ?R112 x (cap_object ?cap116, offset control_cap root_size) xa) (kernel_state s)
 6. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 x (cap_object ?cap116, offset control_cap root_size)) (kernel_state s)
 8. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 9. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 10. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap115 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap94 (fst fail) (snd fail)
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap94 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref. ?cap85 IrqControlCap (IrqControlIssueIrqHandlerIntent irq node_index node_depth) (InvokeIrqControl (IssueIrqHandler irq ref (cap_object root_cap, offset node_index root_size)))
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (10 subgoals):
 1. \<And>s x xa sa sb sc sd. \<lbrakk>cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap; ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) sd\<rbrakk> \<Longrightarrow> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sd \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) sd
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object ?cap116, offset control_cap root_size) = control_ptr
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object ?cap116, offset control_cap root_size) xa \<and>* ?R112 x (cap_object ?cap116, offset control_cap root_size) xa) (kernel_state s)
 6. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 x (cap_object ?cap116, offset control_cap root_size)) (kernel_state s)
 8. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 9. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 10. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (11 subgoals):
 1. \<And>s x xa sa sb sc sd. \<lbrakk>cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap; ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) sd\<rbrakk> \<Longrightarrow> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sd
 2. \<And>s x xa sa sb sc sd. \<lbrakk>cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap; ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) sd\<rbrakk> \<Longrightarrow> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) sd
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object ?cap116, offset control_cap root_size) = control_ptr
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr
 6. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object ?cap116, offset control_cap root_size) xa \<and>* ?R112 x (cap_object ?cap116, offset control_cap root_size) xa) (kernel_state s)
 7. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 8. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 x (cap_object ?cap116, offset control_cap root_size)) (kernel_state s)
 9. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 10. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (10 subgoals):
 1. \<And>s x xa sa sb sc sd. \<lbrakk>cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap; ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) sd\<rbrakk> \<Longrightarrow> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) sd
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object ?cap116, offset control_cap root_size) = control_ptr
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object ?cap116, offset control_cap root_size) xa \<and>* ?R112 x (cap_object ?cap116, offset control_cap root_size) xa) (kernel_state s)
 6. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 x (cap_object ?cap116, offset control_cap root_size)) (kernel_state s)
 8. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 9. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 10. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (10 subgoals):
 1. \<And>s x xa sd. \<lbrakk>cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap; ((cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) sd\<rbrakk> \<Longrightarrow> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* irq \<mapsto>irq obj \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c IrqHandlerCap irq \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R)) sd
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object ?cap116, offset control_cap root_size) = control_ptr
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object ?cap116, offset control_cap root_size) xa \<and>* ?R112 x (cap_object ?cap116, offset control_cap root_size) xa) (kernel_state s)
 6. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 x (cap_object ?cap116, offset control_cap root_size)) (kernel_state s)
 8. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 9. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 10. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (9 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object ?cap116, offset control_cap root_size) = control_ptr
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object ?cap116, offset control_cap root_size) xa \<and>* ?R112 x (cap_object ?cap116, offset control_cap root_size) xa) (kernel_state s)
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 x (cap_object ?cap116, offset control_cap root_size)) (kernel_state s)
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 9. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (9 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c target_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cap_object ?cap116 = cap_object root_cap
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object ?cap116, offset control_cap root_size)), offset croot root_size) = root_ptr
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object ?cap116, offset control_cap root_size) xa \<and>* ?R112 x (cap_object ?cap116, offset control_cap root_size) xa) (kernel_state s)
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object ?cap116, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object ?cap116, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object ?cap116, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object ?cap116, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object ?cap116, offset control_cap root_size))) \<and>* ?R106 x (cap_object ?cap116, offset control_cap root_size)) (kernel_state s)
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup ?cap116 remaining_size sz \<and> guard_equal ?cap116 control_cap remaining_size \<and> is_cnode_cap ?cap116) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap116 \<and>* (\<lambda>a. let c = cap_object ?cap116 in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup ?cap116 word_bits root_size \<and> guard_equal ?cap116 control_cap word_bits \<and> is_cnode_cap ?cap116) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 9. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (8 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object root_cap, offset control_cap root_size)), offset croot root_size) = root_ptr
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object root_cap, offset control_cap root_size) xa \<and>* ?R112 x (cap_object root_cap, offset control_cap root_size) xa) (kernel_state s)
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object root_cap, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object root_cap, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object root_cap, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object root_cap, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object root_cap, offset control_cap root_size))) \<and>* ?R106 x (cap_object root_cap, offset control_cap root_size)) (kernel_state s)
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 7. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 8. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (8 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c target_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> xa = root_cap
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object root_cap, offset control_cap root_size)), offset croot root_size) = root_ptr
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object root_cap, offset control_cap root_size) xa \<and>* ?R112 x (cap_object root_cap, offset control_cap root_size) xa) (kernel_state s)
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object root_cap, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object root_cap, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object root_cap, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object root_cap, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object root_cap, offset control_cap root_size))) \<and>* ?R106 x (cap_object root_cap, offset control_cap root_size)) (kernel_state s)
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 7. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 8. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (7 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> (cap_object (?cap114 x (cap_object root_cap, offset control_cap root_size)), offset croot root_size) = root_ptr
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object root_cap, offset control_cap root_size) xa \<and>* ?R112 x (cap_object root_cap, offset control_cap root_size) xa) (kernel_state s)
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 4. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object root_cap, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object root_cap, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object root_cap, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object root_cap, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object root_cap, offset control_cap root_size))) \<and>* ?R106 x (cap_object root_cap, offset control_cap root_size)) (kernel_state s)
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 6. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 7. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (7 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c target_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cap_object (?cap114 x (cap_object root_cap, offset control_cap root_size)) = cap_object root_cap
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object root_cap, offset control_cap root_size) xa \<and>* ?R112 x (cap_object root_cap, offset control_cap root_size) xa) (kernel_state s)
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 4. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap111 x (cap_object root_cap, offset control_cap root_size) \<and>* (\<lambda>s. let c = cap_object (?cap110 x (cap_object root_cap, offset control_cap root_size)) in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup (?cap109 x (cap_object root_cap, offset control_cap root_size)) word_bits root_size \<and> guard_equal (?cap108 x (cap_object root_cap, offset control_cap root_size)) croot word_bits \<and> is_cnode_cap (?cap107 x (cap_object root_cap, offset control_cap root_size))) \<and>* ?R106 x (cap_object root_cap, offset control_cap root_size)) (kernel_state s)
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 6. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 7. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap114 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object (?cap107 (fst fail) (snd fail)), offset croot root_size)]
\<lambda>fail. ?cap111 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap110 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap109 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
\<lambda>fail. ?cap108 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap107 (fst fail) (snd fail)
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (6 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (\<box> (root_size, unat node_depth) : root_cap node_index \<mapsto>u ?cap113 x (cap_object root_cap, offset control_cap root_size) xa \<and>* ?R112 x (cap_object root_cap, offset control_cap root_size) xa) (kernel_state s)
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 3. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap croot word_bits \<and> is_cnode_cap root_cap) \<and>* ?R106 x (cap_object root_cap, offset control_cap root_size)) (kernel_state s)
 4. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 5. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object root_cap, offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object root_cap, offset croot root_size)]
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (6 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c target_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> cdl.lift (cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c ?cap113 x (cap_object root_cap, offset control_cap root_size) xa \<and>* ?R112 x (cap_object root_cap, offset control_cap root_size) xa) (kernel_state s)
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 3. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap croot word_bits \<and> is_cnode_cap root_cap) \<and>* ?R106 x (cap_object root_cap, offset control_cap root_size)) (kernel_state s)
 4. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 5. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap113 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?cap93 (fst fail) (snd fail) [(c, cap_object root_cap, offset croot root_size)]
\<lambda>fail. ?R112 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail c. ?R92 (fst fail) (snd fail) [(c, cap_object root_cap, offset croot root_size)]
?cap93 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?cap83 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth)
?R92 (ds_id IrqControlCap) \<equiv>\<^sup>? \<lambda>ref cs. ?R81 IrqControlCap ref cs (IrqControlIssueIrqHandlerIntent irq node_index node_depth) proof (prove)
goal (5 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; reset_cap_asid xa = reset_cap_asid root_cap\<rbrakk> \<Longrightarrow> x = IrqControlCap
 2. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap croot word_bits \<and> is_cnode_cap root_cap) \<and>* ?R106 x (cap_object root_cap, offset control_cap root_size)) (kernel_state s)
 3. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 4. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 5. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (4 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset croot root_size) \<mapsto>c root_cap) s \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap croot word_bits \<and> is_cnode_cap root_cap) \<and>* ?R106 x (cap_object root_cap, offset control_cap root_size)) (kernel_state s)
 2. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 3. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (4 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c target_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* ?R106 x (cap_object root_cap, offset control_cap root_size)) (kernel_state s)
 2. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 3. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 2. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c target_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; reset_cap_asid x = reset_cap_asid c_cap; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 2. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c target_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap; ep_related_cap x; ep_related_cap x = ep_related_cap c_cap\<rbrakk> \<Longrightarrow> False
 2. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>s. let a = (root_size, word_bits) in case a of (sz, remaining_size) \<Rightarrow> let slot = offset control_cap sz; c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode sz) \<and>* (c, slot) \<mapsto>c c_cap) s \<and> one_lvl_lookup root_cap remaining_size sz \<and> guard_equal root_cap control_cap remaining_size \<and> is_cnode_cap root_cap) \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (\<lambda>a. let c = cap_object root_cap in (c \<mapsto>f CNode (empty_cnode root_size) \<and>* (c, offset control_cap root_size) \<mapsto>c c_cap) a \<and> one_lvl_lookup root_cap word_bits root_size \<and> guard_equal root_cap control_cap word_bits \<and> is_cnode_cap root_cap) \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c target_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (1 subgoal):
 1. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* control_ptr \<mapsto>c c_cap \<and>* target_ptr \<mapsto>c target_cap \<and>* root_ptr \<mapsto>c root_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap c_cap \<and> one_lvl_lookup root_cap word_bits root_size \<and> one_lvl_lookup root_cap (unat node_depth) root_size \<and> guard_equal root_cap node_index (unat node_depth) \<and> guard_equal root_cap croot word_bits \<and> guard_equal root_cap control_cap word_bits \<and> guard_equal root_cap node_index word_bits \<and> unat node_depth \<le> word_bits \<and> 0 < unat node_depth \<and> is_irqcontrol_cap c_cap \<and> is_cnode_cap root_cap)) s \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* cap_object root_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cap \<and>* (cap_object root_cap, offset control_cap root_size) \<mapsto>c c_cap \<and>* (cap_object root_cap, offset node_index root_size) \<mapsto>c target_cap \<and>* (cap_object root_cap, offset croot root_size) \<mapsto>c root_cap \<and>* R) (kernel_state s); \<not> ep_related_cap c_cap; one_lvl_lookup root_cap word_bits root_size; one_lvl_lookup root_cap (unat node_depth) root_size; guard_equal root_cap node_index (unat node_depth); guard_equal root_cap croot word_bits; guard_equal root_cap control_cap word_bits; guard_equal root_cap node_index word_bits; unat node_depth \<le> word_bits; 0 < unat node_depth; is_irqcontrol_cap c_cap; is_cnode_cap root_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal:
No subgoals!