theory TCB_DP

lemma seL4_TCB_Resume_wp:
  "\<lbrakk> is_cnode_cap cnode_cap;
    \<comment> \<open>Caps point to the right objects.\<close>
     one_lvl_lookup cnode_cap word_bits root_size;
     guard_equal cnode_cap tcb_ref word_bits;
     is_tcb root_tcb;
     is_tcb_cap tcb_cap\<rbrakk> \<Longrightarrow>
   \<lbrace> \<guillemotleft> root_tcb_id \<mapsto>f root_tcb
     \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
     \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap
     \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c -
     \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap
     \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size)
     \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap
     \<and>* R \<guillemotright> \<rbrace>
  seL4_TCB_Resume tcb_ref
  \<lbrace>\<lambda>_.  \<guillemotleft> root_tcb_id \<mapsto>f root_tcb
    \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
    \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap
    \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap)
    \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap
    \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size)
    \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap
    \<and>* R \<guillemotright> \<rbrace>" apply (simp add:seL4_TCB_Resume_def sep_state_projection2_def
    is_tcb_def split:cdl_object.splits) apply (rename_tac cdl_tcb) apply (rule hoare_pre) apply (wp do_kernel_op_pull_back) apply (rule hoare_post_imp[OF _ call_kernel_with_intent_allow_error_helper
     [where check = True,simplified]]) apply simp apply fastforce apply (rule hoare_strengthen_post[OF set_cap_wp]) apply (sep_select 2,sep_cancel) apply (wp+)[4] apply (rule_tac P= "
           iv = (InvokeTcb $ Resume (cap_object tcb_cap))" in hoare_gen_asmEx) apply (clarsimp simp:invoke_tcb_def) apply (wp restart_cdl_current_thread[where cap = NullCap]
           restart_cdl_current_domain[where cap = NullCap]) apply (rule_tac R1="root_tcb_id \<mapsto>f Tcb cdl_tcb
             \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* Q" for Q in
             hoare_post_imp[OF _ restart_null_wp]) apply (rule conjI,sep_solve) apply (rule sep_any_imp_c'_conj) apply sep_cancel apply sep_cancel apply simp apply (simp add:is_pending_cap_def conj_comms) apply (wp set_cap_wp hoare_vcg_conj_lift) apply (rule_tac R1 ="(cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)"
           in hoare_post_imp[OF _ set_cap_wp]) apply sep_cancel apply simp apply (rule_tac R1="root_tcb_id \<mapsto>f Tcb cdl_tcb  \<and>* Q" for Q in
          hoare_post_imp[OF _ set_cap_wp]) apply (sep_select 4,sep_cancel) apply (sep_select 3,sep_cancel) apply (rule_tac P = "c = TcbCap (cap_object tcb_cap) "
          in hoare_gen_asmEx) apply (simp add: decode_invocation_def
          throw_opt_def get_tcb_intent_def decode_tcb_invocation_def) apply wp apply (clarsimp simp: lookup_extra_caps_def mapME_def sequenceE_def) apply (rule returnOk_wp) apply (rule lookup_cap_and_slot_rvu
        [where r=root_size and cap=cnode_cap and cap'=tcb_cap]) apply clarsimp apply (wp hoare_vcg_conj_lift hoare_vcg_imp_lift hoare_vcg_all_lift) apply (wp update_thread_intent_update)+ apply clarify apply (drule_tac x = tcb_cap in spec) apply clarsimp apply (erule use_sep_true_for_sep_map_c) apply sep_solve apply (intro conjI impI allI) apply (clarsimp simp:is_tcb_def reset_cap_asid_tcb
                        split:cdl_object.splits cdl_cap.splits)+ apply (simp add: ep_related_cap_def cap_type_def cap_object_def
                  split: cdl_cap.splits) apply ((rule conjI|sep_solve)+)[1] apply (clarsimp simp: user_pointer_at_def Let_unfold sep_conj_assoc is_tcb_def) apply sep_cancel+ apply sep_solve done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; is_tcb root_tcb; is_tcb_cap tcb_cap\<rbrakk> \<Longrightarrow> \<lbrace>Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> seL4_TCB_Resume tcb_ref \<lbrace>\<lambda>_. Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x3. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb x3\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 cdl_tcb\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrace>
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> ?Q42 cdl_tcb s proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> ?P46 cdl_tcb (kernel_state s) proof (prove)
goal (15 subgoals):
 1. \<And>cdl_tcb rv s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Q53 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op49 cdl_tcb) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr49 cdl_tcb \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_extra49 cdl_tcb
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?R49 cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. ?Q53 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra49 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R49 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror49 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. ?Perror49 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb49 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror49 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Perror49 cdl_tcb\<rbrace>
 8. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV49 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb49 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op49 cdl_tcb) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.49 cdl_tcb s\<rbrace>
 9. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV49 cdl_tcb iv\<rbrace>
 10. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (?intent_op49 cdl_tcb) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?Perror49 cdl_tcb s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op49 cdl_tcb) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr49 cdl_tcb \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_extra49 cdl_tcb
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?R49 cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra49 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R49 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror49 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. ?Perror49 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb49 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra49 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror49 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Perror49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV49 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb49 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op49 cdl_tcb) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.49 cdl_tcb s\<rbrace>
 8. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV49 cdl_tcb iv\<rbrace>
 9. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (?intent_op49 cdl_tcb) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?Perror49 cdl_tcb s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 10. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id (?intent_extra49 cdl_tcb) \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?R49 cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra49 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R49 cdl_tcb\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror49 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. ?Perror49 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb49 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra49 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror49 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Perror49 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV49 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb49 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent TcbResumeIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.49 cdl_tcb s\<rbrace>
 7. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV49 cdl_tcb iv\<rbrace>
 8. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?Perror49 cdl_tcb s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 10. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cdl_tcb rv s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* ?R77 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra49 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R77 cdl_tcb)\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror49 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. ?Perror49 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb49 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra49 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror49 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Perror49 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV49 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb49 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent TcbResumeIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.49 cdl_tcb s\<rbrace>
 7. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV49 cdl_tcb iv\<rbrace>
 8. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?Perror49 cdl_tcb s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 10. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra49 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror49 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. ?Perror49 cdl_tcb\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb49 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra49 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror49 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Perror49 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV49 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb49 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent TcbResumeIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.49 cdl_tcb s\<rbrace>
 6. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV49 cdl_tcb iv\<rbrace>
 7. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?Perror49 cdl_tcb s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 8. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 9. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV49 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent TcbResumeIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.49 cdl_tcb s\<rbrace>
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV49 cdl_tcb iv\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; iv = (InvokeTcb $ Resume (cap_object tcb_cap))\<rbrakk> \<Longrightarrow> \<lbrace>?P'106 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent TcbResumeIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.49 cdl_tcb s\<rbrace>
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'106 cdl_tcb iv and K (iv = (InvokeTcb $ Resume (cap_object tcb_cap)))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'106 cdl_tcb (InvokeTcb (Resume (cap_object tcb_cap)))\<rbrace> restart (cap_object tcb_cap) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s\<rbrace>
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'106 cdl_tcb iv and K (iv = (InvokeTcb $ Resume (cap_object tcb_cap)))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'116 cdl_tcb (InvokeTcb (Resume (cap_object tcb_cap)))\<rbrace> restart (cap_object tcb_cap) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s\<rbrace>
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_thread a = Some root_tcb_id) \<and> (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_domain a = minBound) \<and> ?P'116 cdl_tcb iv a) and K (iv = (InvokeTcb $ Resume (cap_object tcb_cap)))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb rv s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q126 cdl_tcb (InvokeTcb (Resume (cap_object tcb_cap)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_thread a = Some root_tcb_id) \<and> (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_domain a = minBound) \<and> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q126 cdl_tcb iv) a) and K (iv = (InvokeTcb $ Resume (cap_object tcb_cap)))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb rv s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q126 cdl_tcb (InvokeTcb (Resume (cap_object tcb_cap)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_thread a = Some root_tcb_id) \<and> (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_domain a = minBound) \<and> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q126 cdl_tcb iv) a) and K (iv = (InvokeTcb $ Resume (cap_object tcb_cap)))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb rv s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q126 cdl_tcb (InvokeTcb (Resume (cap_object tcb_cap)))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c ?cap146 cdl_tcb rv s \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_thread a = Some root_tcb_id) \<and> (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_domain a = minBound) \<and> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q126 cdl_tcb iv) a) and K (iv = (InvokeTcb $ Resume (cap_object tcb_cap)))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb rv s sa. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ?Q126 cdl_tcb (InvokeTcb (Resume (cap_object tcb_cap)))) sa\<rbrakk> \<Longrightarrow> (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c MasterReplyCap (cap_object tcb_cap) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) sa
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_thread a = Some root_tcb_id) \<and> (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_domain a = minBound) \<and> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?Q126 cdl_tcb iv) a) and K (iv = (InvokeTcb $ Resume (cap_object tcb_cap)))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_thread a = Some root_tcb_id) \<and> (cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_domain a = minBound) \<and> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) a) and K (iv = (InvokeTcb $ Resume (cap_object tcb_cap)))\<rbrace>
 2. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r a. cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> \<not> is_pending_cap NullCap \<and> cdl_current_domain a = minBound \<and> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) a \<and> iv = InvokeTcb (Resume (cap_object tcb_cap))\<rbrace>
 2. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps49 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r a. cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) a \<and> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) a\<rbrace>
 2. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>?Ps49 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P185 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True))\<rbrace>
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'185 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>\<lambda>iv s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> ?P185 cdl_tcb iv s \<and> ?P'185 cdl_tcb iv s\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb iv rv s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'185 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>\<lambda>iv s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> ?P'185 cdl_tcb iv s\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb iv rv s sa. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>a. True)) sa\<rbrakk> \<Longrightarrow> True
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'185 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>\<lambda>iv s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> ?P'185 cdl_tcb iv s\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'185 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 2. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>\<lambda>iv s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> ?P'185 cdl_tcb iv s\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb iv rv s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ?Q207 cdl_tcb iv) s\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>\<lambda>iv s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ?Q207 cdl_tcb iv) s\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb iv rv s sa. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ?Q207 cdl_tcb iv) sa\<rbrakk> \<Longrightarrow> ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) sa
 2. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>\<lambda>iv s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ?Q207 cdl_tcb iv) s\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd49 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>\<lambda>iv s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd49 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; c = TcbCap (cap_object tcb_cap)\<rbrakk> \<Longrightarrow> \<lbrace>?P'246 cdl_tcb c ref cs\<rbrace> decode_invocation c ref cs (TcbIntent TcbResumeIntent) \<lbrace>\<lambda>iv s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?P'246 cdl_tcb (fst r) (snd r) xa and K (fst r = TcbCap (cap_object tcb_cap))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; c = TcbCap (cap_object tcb_cap)\<rbrakk> \<Longrightarrow> \<lbrace>?P'246 cdl_tcb (TcbCap (cap_object tcb_cap)) ref cs\<rbrace> liftME InvokeTcb (returnOk (Resume (cap_object tcb_cap)) \<sqinter> throw) \<lbrace>\<lambda>iv s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s\<rbrace>, \<lbrace>\<lambda>r s. ?P99 cdl_tcb (cdl_current_thread s) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?P'246 cdl_tcb (fst r) (snd r) xa and K (fst r = TcbCap (cap_object tcb_cap))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> ?P99 cdl_tcb (cdl_current_thread s)
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb s. ?P104 cdl_tcb (all_scheduable_tcbs (cdl_objects s)) \<equiv>\<^sup>? \<lambda>cdl_tcb s. ?P99 cdl_tcb (cdl_current_thread s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. (\<lambda>a. True \<and> (((\<lambda>iv s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> iv = InvokeTcb (Resume (cap_object tcb_cap)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s) \<circ> InvokeTcb) (Resume (cap_object tcb_cap)) and (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> True)) a) and K (fst r = TcbCap (cap_object tcb_cap))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> True
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb a aa b. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.49 cdl_tcb a (aa, b)\<rbrace> returnOk [] \<lbrace>\<lambda>xa s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> a = TcbCap (cap_object tcb_cap)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.49 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> True
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (4 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.49 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> fst r = TcbCap (cap_object tcb_cap)) \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.49 cdl_tcb\<rbrace>
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.49 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> True
 4. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap)) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) s\<rbrace>
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap)) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> True
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P49 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> c = TcbCap (cap_object tcb_cap) \<and> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) s\<rbrace>
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap)) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> True
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P49 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb c. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P307 cdl_tcb c\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True))\<rbrace>
 2. \<And>cdl_tcb c. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'307 cdl_tcb c\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> c = TcbCap (cap_object tcb_cap) \<and> \<not> ep_related_cap c\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'299 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb)\<rbrace>
 4. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap)) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> True
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> ?P307 cdl_tcb x (kernel_state s) \<and> ?P'307 cdl_tcb x (kernel_state s)) \<and> ?P'299 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap)) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> True
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> x = TcbCap (cap_object tcb_cap) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; \<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap)) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size)); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> True
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> x = TcbCap (cap_object tcb_cap) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) s; reset_cap_asid tcb_cap = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> fst (tcb_cap, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap)) \<and> \<not> ep_related_cap (fst (tcb_cap, cap_object cnode_cap, offset tcb_ref root_size))\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> True
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> x = TcbCap (cap_object tcb_cap) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s; cdl_current_thread s = Some root_tcb_id; cdl_current_domain s = minBound; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s; tcb_cap = TcbCap (cap_object tcb_cap); \<not> ep_related_cap tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> x = TcbCap (cap_object tcb_cap) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s; cdl_current_thread s = Some root_tcb_id; cdl_current_domain s = minBound; tcb_cap = TcbCap (cap_object tcb_cap); \<not> ep_related_cap tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) s
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> x = TcbCap (cap_object tcb_cap) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb49 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> x = TcbCap (cap_object tcb_cap) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (4 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent TcbResumeIntent), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>
 2. \<And>cdl_tcb s x. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> x = TcbCap (cap_object tcb_cap) \<and> \<not> ep_related_cap x
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)
 4. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> tcb_cap = TcbCap (cap_object tcb_cap) \<and> \<not> ep_related_cap tcb_cap
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb s x8 x71 x72 x73 x74. \<lbrakk>one_lvl_lookup (CNodeCap x71 x72 x73 x74) word_bits root_size; guard_equal (CNodeCap x71 x72 x73 x74) tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (x8, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (x8, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c CNodeCap x71 x72 x73 x74 \<and>* x71 \<mapsto>f CNode (empty_cnode root_size) \<and>* (x71, offset tcb_ref root_size) \<mapsto>c TcbCap x8 \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; tcb_cap = TcbCap x8; cnode_cap = CNodeCap x71 x72 x73 x74\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (x8, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (\<lambda>_. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (x8, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (x8, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c CNodeCap x71 x72 x73 x74 \<and>* x71 \<mapsto>f CNode (empty_cnode root_size) \<and>* (x71, offset tcb_ref root_size) \<mapsto>c TcbCap x8 \<and>* R) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s)
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* ?R292 cdl_tcb) (kernel_state s)
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb s sa sb. \<lbrakk>is_tcb_cap tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ((cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_replycap_slot) \<mapsto>c - \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) sb\<rbrakk> \<Longrightarrow> True proof (prove)
goal:
No subgoals!