theory Arch_DP

lemma seL4_Section_Map_wp:
  notes split_paired_Ex[simp del]
  assumes misc:
  "cap_object cnode_cap = cnode_id" "is_cnode_cap cnode_cap"
  "offset sel_page root_size = frame_offset"
  "offset sel4_page_directory root_size = pd_offset"
  and sz: "one_lvl_lookup cnode_cap word_bits root_size"
          "guard_equal cnode_cap sel4_page_directory word_bits"
          "guard_equal cnode_cap sel_page word_bits"
  shows "\<lbrakk>n = 20 \<or> n = 24
  \<rbrakk> \<Longrightarrow> \<lbrace>
  \<guillemotleft> (root_tcb_id,tcb_pending_op_slot) \<mapsto>c RunningCap
  \<and>* root_tcb_id \<mapsto>f Tcb tcb
  \<and>* (root_tcb_id,tcb_cspace_slot) \<mapsto>c cnode_cap
  \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size)
  \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c -
  \<and>* (cnode_id, pd_offset) \<mapsto>c (PageDirectoryCap pd_ptr real_type None)
  \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R \<guillemotright> \<rbrace>
  seL4_Page_Map sel_page sel4_page_directory vaddr perms vmattr
  \<lbrace>\<lambda>r s. \<guillemotleft> (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
    \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap
    \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c
       FrameCap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n Fake None
    \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None
    \<and>* root_tcb_id \<mapsto>f (Tcb tcb)
    \<and>* (cnode_id, pd_offset) \<mapsto>c (PageDirectoryCap pd_ptr real_type None)
    \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size)
    \<and>* R \<guillemotright> s \<rbrace>" apply (simp add:seL4_Page_Map_def sep_state_projection2_def) apply (rule hoare_name_pre_state) apply (rule hoare_pre) apply (rule do_kernel_op_pull_back) apply (rule call_kernel_with_intent_allow_error_helper
     [where check = True and Perror = \<top>,simplified]) apply fastforce apply (rule set_cap_wp) apply (wp+)[4] apply (rule_tac P = "\<exists>asid'. iv = InvokePage
             (PageMap (FrameCap dev frame_ptr rights n Real asid')
             (FrameCap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n Fake None) (cnode_id,frame_offset)
             [cdl_lookup_pd_slot pd_ptr vaddr])"
             in hoare_gen_asmEx) apply clarsimp apply wp apply (rule_tac P1 = "\<lambda>iv. P1 \<and>* P2" for P1 P2 in hoare_strengthen_post
            [OF invoke_page_wp[where fake = Real
              and fake' = Fake and x = "[cdl_lookup_pd_slot pd_ptr vaddr]" ]]) apply (rule refl) apply simp apply (rule conjI) apply (sep_solve) apply (subst sep_map_c_asid_reset [where ptr = "(cnode_id,frame_offset)"]) prefer 2 apply (sep_erule_concl refl_imp)+ apply (sep_solve) apply (simp add:reset_cap_asid_def) apply (wp hoare_vcg_conj_lift) apply (wp hoare_strengthen_post[OF set_cap_wp]) apply (sep_solve) apply wp apply (rule_tac P = "\<exists>asid asid'. (c = (FrameCap dev frame_ptr rights n Real asid)
         \<and> cs = [(PageDirectoryCap pd_ptr real_type asid',(cnode_id,pd_offset))]
         \<and> ref = (cnode_id,frame_offset))"
         in hoare_gen_asmEx) apply (elim exE)+ apply simp apply (rule_tac Q = "\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and>
                                    cdl_current_domain s = minBound \<and>
          <(root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
          \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap
          \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c -
          \<and>* (cnode_id, frame_offset) \<mapsto>c -
          \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None
          \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*  R> s \<and>
         iv = InvokePage
         (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr))
         (FrameCap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n Fake None) (cnode_id,frame_offset)
          [cdl_lookup_pd_slot pd_ptr vaddr])"
         in hoare_post_impErr[rotated -1]) apply assumption apply (rule hoare_vcg_E_elim) apply wp apply wp apply (rule validE_validE_R) apply (rule hoare_weaken_preE[where P = \<top>]) apply (wp decode_page_map_intent_rv_20_24)[1] apply simp apply simp apply clarsimp apply sep_solve apply (simp add:lookup_extra_caps_def conj_comms mapME_singleton) apply (rule wp_no_exception_seq) apply wp[1] apply (rule lookup_cap_and_slot_rvu[where r = root_size
       and cap' = "PageDirectoryCap pd_ptr real_type None"]) apply (rule hoare_pre) apply (wp lookup_cap_and_slot_rvu[where r = root_size
        and cap' = "FrameCap dev frame_ptr rights n Real None"])[1] apply (erule_tac Q="cdl_current_domain sa = minBound" in conjE, assumption) apply (wp lookup_cap_and_slot_rvu[where r = root_size
       and cap' = "FrameCap dev frame_ptr rights n Real None"])[1] apply clarsimp apply (wp update_thread_intent_update hoare_vcg_all_lift
      hoare_vcg_imp_lift) apply clarsimp defer apply clarsimp using misc sz apply (intro conjI impI allI, simp_all add: reset_cap_asid_simps2) apply (sep_solve) apply simp apply sep_solve apply (clarsimp simp:user_pointer_at_def Let_def
        word_bits_def sep_conj_assoc) apply sep_solve apply (clarsimp dest!:reset_cap_asid_simps2
       simp:ep_related_cap_def) apply (clarsimp simp:user_pointer_at_def Let_def
          word_bits_def sep_conj_assoc) apply (sep_solve) apply clarsimp apply (sep_solve) apply (clarsimp dest!:reset_cap_asid_simps2
       simp:ep_related_cap_def) apply (clarsimp simp:user_pointer_at_def Let_def
          word_bits_def sep_conj_assoc) apply (drule_tac x = "FrameCap dev frame_ptr rights n Real None"  in spec) apply clarsimp apply (erule impE) apply (rule_tac x = "PageDirectoryCap pd_ptr real_type None" in exI) apply simp apply clarsimp apply (sep_solve) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. n = 20 \<or> n = 24 \<Longrightarrow> \<lbrace>Separation_SD.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R)\<rbrace> seL4_Page_Map sel_page sel4_page_directory vaddr perms vmattr \<lbrace>\<lambda>r. Separation_SD.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. n = 20 \<or> n = 24 \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Q2 s\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state s)\<rbrace>
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> ?Q2 s sa proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P5 s\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace>
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> ?P5 s (kernel_state sa) proof (prove)
goal (14 subgoals):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op7 s) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr7 s \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> = ?intent_extra7 s
 2. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7 s\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ra7 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R7 s\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Rb7 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra7 s\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 7. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?PIV7 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb7 s sa\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op7 s) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.7 s sa\<rbrace>
 8. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV7 s iv\<rbrace>
 9. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (?intent_op7 s) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 10. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id (?intent_extra7 s) \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7 s\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace>
 2. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ra7 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R7 s\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Rb7 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra7 s\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 6. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?PIV7 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb7 s sa\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (PageIntent (PageMapIntent vaddr perms vmattr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.7 s sa\<rbrace>
 7. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV7 s iv\<rbrace>
 8. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 10. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ra7 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace>
 2. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Rb7 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra7 s\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 5. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?PIV7 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb7 s sa\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (PageIntent (PageMapIntent vaddr perms vmattr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.7 s sa\<rbrace>
 6. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV7 s iv\<rbrace>
 7. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 8. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 9. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?PIV7 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (PageIntent (PageMapIntent vaddr perms vmattr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.7 s sa\<rbrace>
 2. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV7 s iv\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrakk> \<Longrightarrow> \<lbrace>?P'53 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (PageIntent (PageMapIntent vaddr perms vmattr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.7 s sa\<rbrace>
 2. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'53 s iv and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'53 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace> invoke_page (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>
 2. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'53 s iv and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'64 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace> invoke_page (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>
 2. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> ?P'64 s iv a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr] = PageMap (FrameCap (?dev69 s asid') (?frame_ptr69 s asid') (?rights69 s asid') (?n69 s asid') Real (?asid69 s asid')) (FrameCap False (?frame_ptr69 s asid') (?rights'69 s asid') (?n69 s asid') Fake (?asid'69 s asid')) (?ref78 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) [cdl_lookup_pd_slot pd_ptr vaddr]
 2. \<And>s asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (\<And>* map (\<lambda>ptr. ptr \<mapsto>c FrameCap False (?frame_ptr69 s asid') (?rights'69 s asid') (?n69 s asid') Fake (?asid'69 s asid')) (case InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]) of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* ?ref78 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])) \<mapsto>c FrameCap (?dev69 s asid') (?frame_ptr69 s asid') (?rights69 s asid') (?n69 s asid') Real (?asid69 s asid') \<and>* ?P1.77 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])) \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 3. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((?ref78 s iv) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* ?P1.77 s iv \<and>* ?P2.76 s iv) a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 9. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (\<And>* map (\<lambda>ptr. ptr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (case InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]) of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* ?P1.77 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])) \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 2. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* ?P1.77 s iv \<and>* ?P2.76 s iv) a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* ?P1.77 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])) \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 2. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* ?P1.77 s iv \<and>* ?P2.76 s iv) a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* ?P1.77 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])) \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* ?P1.77 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])) \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 3. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* ?P1.77 s iv \<and>* ?P2.76 s iv) a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 9. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 2. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s iv) a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> reset_cap_asid (FrameCap dev frame_ptr rights n Real None) = reset_cap_asid (?cap'103 s asid' sa)
 2. \<And>s asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c ?cap'103 s asid' sa \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 3. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s iv) a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 9. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c ?cap'103 s asid' sa \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 2. \<And>s asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> reset_cap_asid (FrameCap dev frame_ptr rights n Real None) = reset_cap_asid (?cap'103 s asid' sa)
 3. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s iv) a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 9. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s asid' sa sb sc. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sc\<rbrakk> \<Longrightarrow> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sc
 2. \<And>s asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))) sa\<rbrakk> \<Longrightarrow> reset_cap_asid (FrameCap dev frame_ptr rights n Real None) = reset_cap_asid (FrameCap dev frame_ptr rights n Real asid')
 3. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.76 s iv) a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 9. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift (cdl_lookup_pd_slot pd_ptr vaddr \<mapsto>c fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real asid' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> reset_cap_asid (FrameCap dev frame_ptr rights n Real None) = reset_cap_asid (FrameCap dev frame_ptr rights n Real asid')
 2. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Ps7 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a) and K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 2. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>?Ps7 s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'145 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)\<rbrace>
 2. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'142 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> ?P'145 s iv sa) \<and> ?P'142 s iv sa\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s iv rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R150 s iv) sa\<rbrakk> \<Longrightarrow> cdl.lift ((cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa
 2. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'142 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R150 s iv) sa) \<and> ?P'142 s iv sa\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s iv. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'142 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>
 2. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa) \<and> ?P'142 s iv sa\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd7 s cs c ref\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) s) \<and> K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?Pd7 s xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<exists>asid asid'. c = FrameCap dev frame_ptr rights n Real asid \<and> cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> ref = (cnode_id, frame_offset)\<rbrakk> \<Longrightarrow> \<lbrace>?P'170 s c ref cs\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) s) \<and> K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?P'170 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs asid asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid \<and> cs = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> ref = (cnode_id, frame_offset)\<rbrakk> \<Longrightarrow> \<lbrace>?P'170 s c ref cs\<rbrace> decode_invocation c ref cs (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) s) \<and> K (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?P'170 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c asid asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid\<rbrakk> \<Longrightarrow> \<lbrace>?P'170 s (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case iv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) s \<and> (\<exists>asid'. iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?P'170 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s c asid asid' e sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; ?E173 s c asid asid' e sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s c asid asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid\<rbrakk> \<Longrightarrow> \<lbrace>?P'170 s (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s \<and> iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrace>, \<lbrace>?E173 s c asid asid'\<rbrace>
 3. \<And>s c asid asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case rv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?P'170 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s c asid asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid\<rbrakk> \<Longrightarrow> \<lbrace>?P'170 s (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s \<and> iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrace>, \<lbrace>\<lambda>e sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 2. \<And>s c asid asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case rv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))
 3. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. ?P'170 s (fst r) (snd r) xa and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s c asid asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid\<rbrakk> \<Longrightarrow> \<lbrace>?P177 s (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageIntent (PageMapIntent vaddr perms vmattr)) -, \<lbrace>\<lambda>e sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa\<rbrace>
 2. \<And>s c asid asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid\<rbrakk> \<Longrightarrow> \<lbrace>?P'176 s (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s \<and> iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrace>, -
 3. \<And>s c asid asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case rv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ?P177 s (fst r) (snd r) xa a \<and> ?P'176 s (fst r) (snd r) xa a) and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s c asid asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid\<rbrakk> \<Longrightarrow> \<lbrace>?P'176 s (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s \<and> iv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrace>, -
 2. \<And>s c asid asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case rv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))
 3. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> ?P'176 s (fst r) (snd r) xa a) and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s c asid asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid\<rbrakk> \<Longrightarrow> \<lbrace>?P'205 (PageDirectoryCap pd_ptr real_type asid') (PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset) s (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>rv s. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrace>, -
 2. \<And>s c asid asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case rv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))
 3. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> ?P'205 (fst (hd xa)) (hd xa) s (fst r) (snd r) xa a) and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s c asid asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid\<rbrakk> \<Longrightarrow> \<lbrace>?P'205 (PageDirectoryCap pd_ptr real_type asid') (PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset) s (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]\<rbrace> decode_invocation (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>rv s. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s c asid asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case rv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))
 3. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> ?P'205 (fst (hd xa)) (hd xa) s (fst r) (snd r) xa a) and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s c asid asid'. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid\<rbrakk> \<Longrightarrow> \<lbrace>?Q214 s c asid asid'\<rbrace> decode_invocation (FrameCap dev frame_ptr rights n Real asid) (cnode_id, frame_offset) [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] (PageIntent (PageMapIntent vaddr perms vmattr)) \<lbrace>\<lambda>rv s. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s c asid asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; True\<rbrakk> \<Longrightarrow> ?Q214 s c asid asid' sa
 3. \<And>s c asid asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case rv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))
 4. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 8. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s c asid asid' sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; True\<rbrakk> \<Longrightarrow> True \<and> InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]) = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])
 2. \<And>s c asid asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case rv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))
 3. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c asid asid' rv sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa \<and> rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr)) (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr])\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* \<And>* map sep_any_map_c (case rv of InvokePage (PageMap cap cap' ref xs) \<Rightarrow> xs) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa \<and> (\<exists>asid'. rv = InvokePage (PageMap (FrameCap dev frame_ptr rights n Real asid') (fake_frame_cap False frame_ptr (validate_vm_rights (rights \<inter> perms)) n) (cnode_id, frame_offset) [cdl_lookup_pd_slot pd_ptr vaddr]))
 2. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c asid sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); c = FrameCap dev frame_ptr rights n Real asid; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa
 2. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl_current_thread sa = Some root_tcb_id; cdl_current_domain sa = minBound; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (cnode_id, frame_offset) \<mapsto>c - \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R)) sa
 2. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [sel4_page_directory] \<lbrace>\<lambda>xa. (\<lambda>a. ((\<lambda>a. True) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a \<and> True) and K (\<exists>asid asid'. fst r = FrameCap dev frame_ptr rights n Real asid \<and> xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)] \<and> snd r = (cnode_id, frame_offset))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 4. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id sel4_page_directory;
returnOk [x]
odE \<lbrace>\<lambda>xa s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> snd r = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> (\<exists>asid. fst r = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 4. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s r ra. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'268 s r ra\<rbrace> returnOk [ra] \<lbrace>\<lambda>xa s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> snd r = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> (\<exists>asid. fst r = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. xa = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id sel4_page_directory \<lbrace>?P'268 s r\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (5 subgoals):
 1. \<And>s r. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.7 s (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id sel4_page_directory \<lbrace>\<lambda>ra a. cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id \<and> snd r = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>asid. fst r = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. [ra] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) a\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ?Pd1.7 s (fst r) (snd r) sa \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 4. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.7 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd r = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. fst r = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. [(c, cap_object (?cap282 s (fst r) (snd r)), offset sel4_page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s (fst r) (snd r) \<and>* \<box> (root_size, word_bits) : ?cap280 s (fst r) (snd r) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s (fst r) (snd r)) sa) \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 3. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 4. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap280 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap282 s (fst r) (snd r)
\<lambda>s r. ?cap280 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap281 s (fst r) (snd r) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?Q283 s\<rbrace> lookup_cap_and_slot root_tcb_id sel_page \<lbrace>\<lambda>r sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd r = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. fst r = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. [(c, cap_object (?cap282 s (fst r) (snd r)), offset sel4_page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd r) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s (fst r) (snd r) \<and>* \<box> (root_size, word_bits) : ?cap280 s (fst r) (snd r) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s (fst r) (snd r)) sa) \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> ?Q283 s sa
 3. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 4. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap282 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r)
\<lambda>s r. ?cap281 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r) proof (prove)
goal (4 subgoals):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid (FrameCap dev frame_ptr rights n Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap287 s), offset sel_page root_size) = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. fst (c, cap_object (?cap287 s), offset sel_page root_size) = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. [(ca, cap_object (?cap282 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))), offset sel4_page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<and>* \<box> (root_size, word_bits) : ?cap280 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap287 s), offset sel_page root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa
 2. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.7 s\<rbrace>
 3. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ?Pd2.7 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 4. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap282 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r)
\<lambda>s r. ?cap281 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid (FrameCap dev frame_ptr rights n Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap287 s), offset sel_page root_size) = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. fst (c, cap_object (?cap287 s), offset sel_page root_size) = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. [(ca, cap_object (?cap282 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))), offset sel4_page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<and>* \<box> (root_size, word_bits) : ?cap280 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap287 s), offset sel_page root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa) \<and> cdl_current_domain sa = minBound\<rbrace>
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ((\<forall>c. reset_cap_asid c = reset_cap_asid (FrameCap dev frame_ptr rights n Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap287 s), offset sel_page root_size) = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. fst (c, cap_object (?cap287 s), offset sel_page root_size) = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. [(ca, cap_object (?cap282 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))), offset sel4_page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<and>* \<box> (root_size, word_bits) : ?cap280 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap287 s), offset sel_page root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa) \<and> cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 3. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap282 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r)
\<lambda>s r. ?cap281 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. (\<forall>c. reset_cap_asid c = reset_cap_asid (FrameCap dev frame_ptr rights n Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap287 s), offset sel_page root_size) = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. fst (c, cap_object (?cap287 s), offset sel_page root_size) = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. [(ca, cap_object (?cap282 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))), offset sel4_page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<and>* \<box> (root_size, word_bits) : ?cap280 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap287 s), offset sel_page root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa \<and> cdl_current_domain sa = minBound\<rbrace>
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ((\<forall>c. reset_cap_asid c = reset_cap_asid (FrameCap dev frame_ptr rights n Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap287 s), offset sel_page root_size) = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. fst (c, cap_object (?cap287 s), offset sel_page root_size) = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. [(ca, cap_object (?cap282 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))), offset sel4_page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<and>* \<box> (root_size, word_bits) : ?cap280 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap287 s), offset sel_page root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa) \<and> cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 3. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap282 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r)
\<lambda>s r. ?cap281 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<lbrace>?P7 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. (\<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> (\<forall>ca. reset_cap_asid ca = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> cap_object (?cap287 s) = cnode_id \<and> offset sel_page root_size = frame_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. c = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. ca = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap282 s c (cap_object (?cap287 s), offset sel_page root_size)) = cnode_id \<and> offset sel4_page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap287 s), offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s c (cap_object (?cap287 s), offset sel_page root_size) \<and>* \<box> (root_size, word_bits) : ?cap280 s c (cap_object (?cap287 s), offset sel_page root_size) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s c (cap_object (?cap287 s), offset sel_page root_size)) sa \<and> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa \<and> cdl_current_domain sa = minBound\<rbrace>
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ((\<forall>c. reset_cap_asid c = reset_cap_asid (FrameCap dev frame_ptr rights n Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap287 s), offset sel_page root_size) = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. fst (c, cap_object (?cap287 s), offset sel_page root_size) = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. [(ca, cap_object (?cap282 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))), offset sel4_page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<and>* \<box> (root_size, word_bits) : ?cap280 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap287 s), offset sel_page root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa) \<and> cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 3. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P7 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap282 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r)
\<lambda>s r. ?cap281 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); ((\<forall>c. reset_cap_asid c = reset_cap_asid (FrameCap dev frame_ptr rights n Real None) \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid (PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_domain sa = minBound \<and> cdl_current_thread sa = Some root_tcb_id \<and> snd (c, cap_object (?cap287 s), offset sel_page root_size) = (cnode_id, frame_offset) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. fst (c, cap_object (?cap287 s), offset sel_page root_size) = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. [(ca, cap_object (?cap282 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))), offset sel4_page_directory root_size)] = [(PageDirectoryCap pd_ptr real_type asid', cnode_id, pd_offset)]) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) \<and>* \<box> (root_size, word_bits) : ?cap280 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size)) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s (fst (c, cap_object (?cap287 s), offset sel_page root_size)) (snd (c, cap_object (?cap287 s), offset sel_page root_size))) sa) \<and> \<not> ep_related_cap (fst (c, cap_object (?cap287 s), offset sel_page root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa) \<and> cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> FrameCap dev frame_ptr rights n Real None \<or> (\<forall>xa. reset_cap_asid xa \<noteq> PageDirectoryCap pd_ptr real_type None \<or> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cap_object (?cap287 s) = cnode_id \<and> offset sel_page root_size = frame_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> (\<exists>asid. x = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. xa = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap282 s x (cap_object (?cap287 s), offset sel_page root_size)) = cnode_id \<and> offset sel4_page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap287 s), offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s x (cap_object (?cap287 s), offset sel_page root_size) \<and>* \<box> (root_size, word_bits) : ?cap280 s x (cap_object (?cap287 s), offset sel_page root_size) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s x (cap_object (?cap287 s), offset sel_page root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) (kernel_state sa) \<and> cdl_current_domain (kernel_state sa) = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap282 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r)
\<lambda>s r. ?cap281 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> (\<forall>ca. reset_cap_asid ca = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object (?cap287 s) = cnode_id \<and> offset sel_page root_size = frame_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. c = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. ca = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap282 s c (cap_object (?cap287 s), offset sel_page root_size)) = cnode_id \<and> offset sel4_page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap287 s), offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s c (cap_object (?cap287 s), offset sel_page root_size) \<and>* \<box> (root_size, word_bits) : ?cap280 s c (cap_object (?cap287 s), offset sel_page root_size) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s c (cap_object (?cap287 s), offset sel_page root_size)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> FrameCap dev frame_ptr rights n Real None \<or> (\<forall>xa. reset_cap_asid xa \<noteq> PageDirectoryCap pd_ptr real_type None \<or> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cap_object (?cap287 s) = cnode_id \<and> offset sel_page root_size = frame_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> (\<exists>asid. x = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. xa = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap282 s x (cap_object (?cap287 s), offset sel_page root_size)) = cnode_id \<and> offset sel4_page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap287 s), offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s x (cap_object (?cap287 s), offset sel_page root_size) \<and>* \<box> (root_size, word_bits) : ?cap280 s x (cap_object (?cap287 s), offset sel_page root_size) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s x (cap_object (?cap287 s), offset sel_page root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) (kernel_state sa) \<and> cdl_current_domain (kernel_state sa) = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s r. ?cap282 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r)
\<lambda>s r. ?cap281 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (PageIntent (PageMapIntent vaddr perms vmattr)), cdl_intent_error = False, cdl_intent_cap = sel_page, cdl_intent_extras = [sel4_page_directory], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> FrameCap dev frame_ptr rights n Real None \<or> (\<forall>xa. reset_cap_asid xa \<noteq> PageDirectoryCap pd_ptr real_type None \<or> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cap_object (?cap287 s) = cnode_id \<and> offset sel_page root_size = frame_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> (\<exists>asid. x = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. xa = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap282 s x (cap_object (?cap287 s), offset sel_page root_size)) = cnode_id \<and> offset sel4_page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap287 s), offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s x (cap_object (?cap287 s), offset sel_page root_size) \<and>* \<box> (root_size, word_bits) : ?cap280 s x (cap_object (?cap287 s), offset sel_page root_size) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s x (cap_object (?cap287 s), offset sel_page root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) (kernel_state sa) \<and> cdl_current_domain (kernel_state sa) = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> (\<forall>ca. reset_cap_asid ca = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object (?cap287 s) = cnode_id \<and> offset sel_page root_size = frame_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. c = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. ca = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap282 s c (cap_object (?cap287 s), offset sel_page root_size)) = cnode_id \<and> offset sel4_page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap287 s), offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s c (cap_object (?cap287 s), offset sel_page root_size) \<and>* \<box> (root_size, word_bits) : ?cap280 s c (cap_object (?cap287 s), offset sel_page root_size) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s c (cap_object (?cap287 s), offset sel_page root_size)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s r. ?cap282 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r)
\<lambda>s r. ?cap281 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r) proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa)\<rbrakk> \<Longrightarrow> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x = FrameCap dev frame_ptr rights n Real None \<longrightarrow> (\<forall>xa. reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cap_object (?cap287 sa) = cnode_id \<and> offset sel_page root_size = frame_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> (\<exists>asid. x = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. xa = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap282 sa x (cap_object (?cap287 sa), offset sel_page root_size)) = cnode_id \<and> offset sel4_page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap287 sa), offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 sa x (cap_object (?cap287 sa), offset sel_page root_size) \<and>* \<box> (root_size, word_bits) : ?cap280 sa x (cap_object (?cap287 sa), offset sel_page root_size) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 sa x (cap_object (?cap287 sa), offset sel_page root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 sa \<and>* \<box> (root_size, word_bits) : ?cap287 sa sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 sa) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> (\<forall>ca. reset_cap_asid ca = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object (?cap287 s) = cnode_id \<and> offset sel_page root_size = frame_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. c = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. ca = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap282 s c (cap_object (?cap287 s), offset sel_page root_size)) = cnode_id \<and> offset sel4_page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap287 s), offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s c (cap_object (?cap287 s), offset sel_page root_size) \<and>* \<box> (root_size, word_bits) : ?cap280 s c (cap_object (?cap287 s), offset sel_page root_size) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s c (cap_object (?cap287 s), offset sel_page root_size)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s r. ?cap282 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r)
\<lambda>s r. ?cap281 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r) proof (prove)
using this:
cap_object cnode_cap = cnode_id
is_cnode_cap cnode_cap
offset sel_page root_size = frame_offset
offset sel4_page_directory root_size = pd_offset
one_lvl_lookup cnode_cap word_bits root_size
guard_equal cnode_cap sel4_page_directory word_bits
guard_equal cnode_cap sel_page word_bits

goal (2 subgoals):
 1. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa)\<rbrakk> \<Longrightarrow> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x = FrameCap dev frame_ptr rights n Real None \<longrightarrow> (\<forall>xa. reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cap_object (?cap287 sa) = cnode_id \<and> offset sel_page root_size = frame_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> (\<exists>asid. x = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. xa = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap282 sa x (cap_object (?cap287 sa), offset sel_page root_size)) = cnode_id \<and> offset sel4_page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap287 sa), offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 sa x (cap_object (?cap287 sa), offset sel_page root_size) \<and>* \<box> (root_size, word_bits) : ?cap280 sa x (cap_object (?cap287 sa), offset sel_page root_size) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 sa x (cap_object (?cap287 sa), offset sel_page root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 sa \<and>* \<box> (root_size, word_bits) : ?cap287 sa sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 sa) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> (\<forall>ca. reset_cap_asid ca = PageDirectoryCap pd_ptr real_type None \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object (?cap287 s) = cnode_id \<and> offset sel_page root_size = frame_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> (\<exists>asid. c = FrameCap dev frame_ptr rights n Real asid) \<and> (\<exists>asid'. ca = PageDirectoryCap pd_ptr real_type asid') \<and> cap_object (?cap282 s c (cap_object (?cap287 s), offset sel_page root_size)) = cnode_id \<and> offset sel4_page_directory root_size = pd_offset \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object (?cap287 s), offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap281 s c (cap_object (?cap287 s), offset sel_page root_size) \<and>* \<box> (root_size, word_bits) : ?cap280 s c (cap_object (?cap287 s), offset sel_page root_size) sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s c (cap_object (?cap287 s), offset sel_page root_size)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap287 s \<and>* \<box> (root_size, word_bits) : ?cap287 s sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa
flex-flex pairs:
\<lambda>s r. ?cap282 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r)
\<lambda>s r. ?cap281 s (fst r) (snd r) \<equiv>\<^sup>? \<lambda>s r. ?cap280 s (fst r) (snd r) proof (prove)
goal (7 subgoals):
 1. \<And>sa x xa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>sa x xa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)
 3. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 sa x (cap_object cnode_cap, frame_offset)) (kernel_state sa)
 4. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 5. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 sa) (kernel_state sa)
 6. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 7. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s c (cap_object cnode_cap, frame_offset)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (6 subgoals):
 1. \<And>sa x xa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)
 2. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 sa x (cap_object cnode_cap, frame_offset)) (kernel_state sa)
 3. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 4. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 sa) (kernel_state sa)
 5. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s c (cap_object cnode_cap, frame_offset)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (6 subgoals):
 1. \<And>sa x xa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; reset_cap_asid xa = PageDirectoryCap pd_ptr real_type None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) (kernel_state sa)
 2. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 sa x (cap_object cnode_cap, frame_offset)) (kernel_state sa)
 3. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 4. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 sa) (kernel_state sa)
 5. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 6. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s c (cap_object cnode_cap, frame_offset)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 sa x (cap_object cnode_cap, frame_offset)) (kernel_state sa)
 2. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 3. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 sa) (kernel_state sa)
 4. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s c (cap_object cnode_cap, frame_offset)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (5 subgoals):
 1. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel4_page_directory 32; guard_equal cnode_cap sel_page 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; cdl_current_thread (kernel_state sa) = Some root_tcb_id; cdl_current_domain (kernel_state sa) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* ?R279 sa x (cap_object cnode_cap, offset sel_page root_size)) (kernel_state sa)
 2. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 3. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 sa) (kernel_state sa)
 4. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 5. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* ?R279 s c (cap_object cnode_cap, frame_offset)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (4 subgoals):
 1. \<And>sa x. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = FrameCap dev frame_ptr rights n Real None; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 2. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 sa) (kernel_state sa)
 3. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 4. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 sa) (kernel_state sa)
 2. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 3. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel4_page_directory 32; guard_equal cnode_cap sel_page 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; cdl_current_thread (kernel_state sa) = Some root_tcb_id; cdl_current_domain (kernel_state sa) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* ?R287 sa) (kernel_state sa)
 2. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 3. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* ?R287 s) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state sa); is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 sa) \<and>* (\<lambda>s. True)) (kernel_state sa)
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb7 s) \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cnode_id, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object cnode_cap = cnode_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, pd_offset) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, frame_offset) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; cdl_current_domain sa = minBound; cap_object cnode_cap = cnode_id; is_cnode_cap cnode_cap; offset sel_page root_size = frame_offset; offset sel4_page_directory root_size = pd_offset; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel4_page_directory \<mapsto>u PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa \<and> \<not> (case c of EndpointCap o_id badge rights \<Rightarrow> True | NotificationCap o_id badge rights \<Rightarrow> True | ReplyCap o_id rights \<Rightarrow> True | _ \<Rightarrow> False); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap sel_page \<mapsto>u FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap sel4_page_directory word_bits; guard_equal cnode_cap sel_page word_bits; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); \<forall>c. reset_cap_asid c = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa \<and> \<not> (case c of EndpointCap o_id badge rights \<Rightarrow> True | NotificationCap o_id badge rights \<Rightarrow> True | ReplyCap o_id rights \<Rightarrow> True | _ \<Rightarrow> False); cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; guard_equal cnode_cap sel4_page_directory 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel_page 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; guard_equal cnode_cap sel4_page_directory 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel_page 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; reset_cap_asid (FrameCap dev frame_ptr rights n Real None) = FrameCap dev frame_ptr rights n Real None \<longrightarrow> ((\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa \<and> \<not> (case FrameCap dev frame_ptr rights n Real None of EndpointCap o_id badge rights \<Rightarrow> True | NotificationCap o_id badge rights \<Rightarrow> True | ReplyCap o_id rights \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; guard_equal cnode_cap sel4_page_directory 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel_page 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; (\<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None) \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; guard_equal cnode_cap sel4_page_directory 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel_page 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa\<rbrakk> \<Longrightarrow> \<exists>c. reset_cap_asid c = PageDirectoryCap pd_ptr real_type None
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; guard_equal cnode_cap sel4_page_directory 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel_page 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa; cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; guard_equal cnode_cap sel4_page_directory 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel_page 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa\<rbrakk> \<Longrightarrow> reset_cap_asid (PageDirectoryCap pd_ptr real_type None) = PageDirectoryCap pd_ptr real_type None
 2. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; guard_equal cnode_cap sel4_page_directory 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel_page 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa; cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; guard_equal cnode_cap sel4_page_directory 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel_page 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa; cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>n = 20 \<or> n = 24; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) (kernel_state s); cdl_current_domain sa = minBound; is_cnode_cap cnode_cap; guard_equal cnode_cap sel4_page_directory 32; cnode_id = cap_object cnode_cap; frame_offset = offset sel_page root_size; pd_offset = offset sel4_page_directory root_size; one_lvl_lookup cnode_cap 32 root_size; guard_equal cnode_cap sel_page 32; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* R) sa; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c FrameCap dev frame_ptr rights n Real None \<and>* R) sa; cdl_current_thread sa = Some root_tcb_id; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cdl_lookup_pd_slot pd_ptr vaddr) \<mapsto>c - \<and>* (cap_object cnode_cap, offset sel_page root_size) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset sel4_page_directory root_size) \<mapsto>c PageDirectoryCap pd_ptr real_type None \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* R) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa proof (prove)
goal:
No subgoals!