theory TCB_DP

lemma TCB_Configure_wp:
assumes unify: "cnode_id = cap_object cnode_cap \<and>
     tcb_id = cap_object tcb_cap \<and>
     offset tcb_root root_size = tcb_cap_slot \<and>
     offset cspace_root root_size = cspace_slot \<and>
     offset vspace_root root_size = vspace_slot \<and>
     offset buffer_frame_root root_size =  buffer_frame_slot"
shows
  "\<lbrakk>
     is_pd_cap vspace_cap; is_frame_cap buffer_frame_cap;
     is_cnode_cap cspace_cap;
     is_cnode_cap cnode_cap;
     buffer_addr \<noteq> 0;
     cap_has_object tcb_cap;
    \<comment> \<open>Caps point to the right objects.\<close>
     one_lvl_lookup cnode_cap word_bits root_size;
     guard_equal cnode_cap tcb_root word_bits;
     guard_equal cnode_cap cspace_root word_bits;
     guard_equal cnode_cap vspace_root word_bits;
     guard_equal cnode_cap buffer_frame_root word_bits;
     cspace_cap' = update_cap_data_det cspace_root_data cspace_cap;
     new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb;
     ~ ep_related_cap tcb_cap;
     is_tcb root_tcb;
     is_tcb_cap tcb_cap;
     ~is_memory_cap tcb_cap;
     cnode_id = cap_object cnode_cap;
     tcb_id = cap_object tcb_cap;
     offset tcb_root root_size = tcb_cap_slot;
     offset cspace_root root_size = cspace_slot;
     offset vspace_root root_size = vspace_slot;
     offset buffer_frame_root root_size =  buffer_frame_slot\<rbrakk>
   \<Longrightarrow> \<lbrace>\<lambda>s.
     \<guillemotleft>root_tcb_id \<mapsto>f root_tcb \<and>*
     (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*

     \<comment> \<open>Root CNode.\<close>
     cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
     \<comment> \<open>Cap to the root CNode.\<close>
     (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
     \<comment> \<open>Cap that the root task has to its own CNode.\<close>
     (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>*

     \<comment> \<open>TCB's stuff\<close>
     tcb_id    \<mapsto>f Tcb tcb \<and>*

     \<comment> \<open>Where to copy the cap from (in the client CNode).\<close>
     (cnode_id, tcb_cap_slot) \<mapsto>c tcb_cap \<and>*
     (cnode_id, cspace_slot)  \<mapsto>c cspace_cap \<and>*
     (cnode_id, vspace_slot)  \<mapsto>c vspace_cap \<and>*
     (cnode_id, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>*

     \<comment> \<open>Cap to the TCB.\<close>
     (tcb_id, tcb_cspace_slot) \<mapsto>c NullCap \<and>*
     (tcb_id, tcb_vspace_slot) \<mapsto>c NullCap \<and>*
     (tcb_id, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>*
      R\<guillemotright> s \<and>
      cap_object cnode_cap = cnode_id \<and>
      cap_object cnode_cap' = cnode_id \<and>

      cap_object tcb_cap    = tcb_id \<and>
      tcb_cap_slot = offset tcb_root root_size \<and>

      cspace_slot = offset cspace_root root_size \<and>
      vspace_slot = offset vspace_root root_size \<and>
      buffer_frame_slot = offset buffer_frame_root root_size \<rbrace>
  seL4_TCB_Configure tcb_root fault_ep
                     cspace_root cspace_root_data
                     vspace_root vspace_root_data
                     buffer_addr buffer_frame_root
  \<lbrace>\<lambda>rv s. \<guillemotleft>root_tcb_id \<mapsto>f root_tcb \<and>*
       (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*

       \<comment> \<open>Root CNode.\<close>
       cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
       \<comment> \<open>Cap to the root CNode.\<close>
       (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
       \<comment> \<open>Cap that the root task has to its own CNode.\<close>
       (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>*

       \<comment> \<open>TCB's stuff\<close>
       tcb_id    \<mapsto>f Tcb new_tcb_fields \<and>*

       \<comment> \<open>Where to copy the cap from (in the client CNode).\<close>
       (cnode_id, tcb_cap_slot) \<mapsto>c tcb_cap \<and>*
       (cnode_id, cspace_slot)  \<mapsto>c cspace_cap \<and>*
       (cnode_id, vspace_slot)  \<mapsto>c vspace_cap \<and>*
       (cnode_id, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>*

       \<comment> \<open>Cap to the TCB.\<close>
       (tcb_id, tcb_cspace_slot) \<mapsto>c (cdl_update_cnode_cap_data cspace_cap cspace_root_data)\<and>*
       (tcb_id, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>*
       (tcb_id, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>*
       R\<guillemotright> s\<rbrace>" using unify apply (simp add: seL4_TCB_Configure_def sep_state_projection2_def) apply (simp only: is_tcb_def split:cdl_object.splits) apply (rename_tac cdl_tcb sz) apply (rule hoare_pre) apply (wp do_kernel_op_pull_back) apply (rule_tac tcb=cdl_tcb in call_kernel_with_intent_allow_error_helper
                [where check = True and Perror = \<top>,simplified]) apply (fastforce) apply (rule hoare_strengthen_post[OF set_cap_wp]) apply (sep_schem) apply (wp+)[4] apply (rule_tac P= "
          \<exists>cspace_cap' vspace_cap' buffer_frame_cap'.
          iv = (InvokeTcb $
          ThreadControl
          (cap_object tcb_cap)
          (cnode_id, tcb_cap_slot)
          (Some fault_ep)
          (Some (cspace_cap', (cnode_id, cspace_slot)))
          (Some (vspace_cap', (cnode_id, vspace_slot)))
          (Some (buffer_frame_cap', (cnode_id, buffer_frame_slot) ))) \<and>
          reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and>
          reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and>
          reset_cap_asid buffer_frame_cap = reset_cap_asid (buffer_frame_cap') " in hoare_gen_asmEx) apply (simp) apply (elim exE) supply [[simproc del: defined_all]] apply simp apply (rule false_e_explode) apply (rule no_exception_conj') apply (wp invoke_tcb_ThreadControl_cur_thread)[1] apply (clarsimp cong:reset_cap_asid_cap_type) apply (clarsimp dest!:reset_cap_asid_cap_type) apply (rule no_exception_conj') apply (wp invoke_tcb_ThreadControl_cdl_current_domain)[1] apply (clarsimp cong:reset_cap_asid_cap_type) apply (clarsimp dest!:reset_cap_asid_cap_type) apply (rule hoare_post_impErr) apply (rule_tac R = "(root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* R'" for R' in
            invoke_tcb_threadcontrol_wp'[where vrt_cap = vspace_cap and
            crt_cap = "cdl_update_cnode_cap_data cspace_cap cspace_root_data" and
            ipcbuff_cap = buffer_frame_cap and tcb = tcb]) apply (rule_tac x = "invoke_tcb_cspace iv" in  exI) apply (rule_tac x = "invoke_tcb_vspace iv" in exI) apply (rule_tac x = "invoke_tcb_ipcbuffer iv" in exI) apply (intro exI conjI,simp_all add:invoke_tcb_cspace_def
           invoke_tcb_vspace_def invoke_tcb_ipcbuffer_def)[1] apply (rule conjI) prefer 2 apply (simp add: sep_conj_assoc update_tcb_fault_endpoint_def) apply (clarsimp simp:unify dest!:cap_typeD) apply (rule sep_map_c_any[where cap = RestartCap]) apply (sep_schem) apply sep_solve apply assumption apply (rule_tac Q = "\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and>
          cdl_current_domain s = minBound \<and>
          (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'.
          iv = (InvokeTcb $
          ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep)
          (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot))
          (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and>
          reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and>
          reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and>
          reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')
          \<and> <cap_object tcb_cap \<mapsto>f Tcb tcb \<and>*
          (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>*
          (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>*
          (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>*
          (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>*
          (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>*
          (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>*
          (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>*
          (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>*
          root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>*
          cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>*
          (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R> s"
          in  hoare_strengthen_post) apply wp apply clarsimp apply (rule hoare_strengthen_post[OF set_cap_wp]) apply (sep_schem) apply clarsimp apply (rule conjI, sep_solve, sep_solve) apply clarsimp apply (rule no_exception_conjE) apply wp[1] apply (rule no_exception_conjE) apply wp[1] apply (rule no_exception_conjE) apply (wp  decode_invocation_tcb_rv''[simplified, where xs="[]" and
         croot_slot="(cnode_id, cspace_slot)" and
         vroot_slot="(cnode_id, vspace_slot)" and
         ipcbuff_slot="(cnode_id, buffer_frame_slot)"])+ apply (rule_tac P="is_tcb_cap c" in hoare_gen_asmEx ) apply (rule split_error_validE) apply (clarsimp simp: decode_tcb_invocation_simps) including no_pre apply (wp) apply (clarsimp simp: comp_def) apply (wp+)[2] apply (simp add:lookup_extra_caps_def Let_def
       mapME_def sequenceE_def get_index_def bindE_assoc) apply (rule wp_no_exception_seq) apply (rule wp_no_exception_seq) apply (rule wp_no_exception_seq) apply wp[1] apply (rule lookup_cap_and_slot_rvu[where r=root_size and cap=cnode_cap and cap'=buffer_frame_cap]) apply (rule lookup_cap_and_slot_rvu[where r=root_size and cap=cnode_cap and cap'=vspace_cap]) apply (clarsimp simp: split_def) apply (rule_tac P="a=tcb_cap \<and> (aa, b) = (cap_object cnode_cap, offset tcb_root root_size)" in hoare_gen_asmEx) apply (clarsimp)[1] apply (rule lookup_cap_and_slot_rvu[where r=root_size and cap=cnode_cap and cap'=cspace_cap]) apply (rule hoare_weaken_preE) apply (rule lookup_cap_and_slot_rvu[where r=root_size and cap=cnode_cap and cap'=tcb_cap]) apply (erule_tac Q="cdl_current_domain s = minBound" in conjE) apply (assumption) apply (simp add: split_def) apply clarsimp apply (wp hoare_vcg_ball_lift hoare_vcg_conj_lift hoare_vcg_imp_lift hoare_vcg_all_lift) apply (rule update_thread_intent_update) apply (wp hoare_vcg_ball_lift
                   hoare_vcg_imp_lift hoare_vcg_ex_lift hoare_vcg_all_lift
                   update_thread_intent_update)+ defer apply (clarsimp) apply (intro conjI allI impI disjI2) apply (clarsimp dest!:reset_cap_asid_cnode_cap simp:cnode_cap_reset_asid)+ apply sep_cancel+ apply (clarsimp simp:is_tcb_cap_is_object) apply sep_solve apply (clarsimp simp: dest!:reset_cap_asid_cnode_cap) apply (drule reset_cap_asid_mem_mapping[where buffer_frame_cap = buffer_frame_cap,rotated]) apply simp apply simp apply (clarsimp simp: unify user_pointer_at_def Let_unfold sep_conj_assoc, sep_solve)+ apply (clarsimp simp:reset_cap_asid_tcb)+ apply (clarsimp simp: unify user_pointer_at_def Let_unfold sep_conj_assoc, sep_solve) apply (clarsimp simp: unify user_pointer_at_def Let_unfold sep_conj_assoc, sep_solve) apply clarsimp apply (drule_tac x = tcb_cap in spec) apply (clarsimp cong:cap_type_bad_cong) apply (drule_tac x = cspace_cap in spec,clarsimp) apply (elim impE exE,fastforce) apply (elim impE allE conjE,fastforce) apply clarsimp apply (drule use_sep_true_for_sep_map_c) apply assumption apply (sep_select_asm 4) apply (sep_solve) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_pd_cap vspace_cap; is_frame_cap buffer_frame_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; is_tcb root_tcb; is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cnode_id, cspace_slot) \<mapsto>c cspace_cap \<and>* (cnode_id, vspace_slot) \<mapsto>c vspace_cap \<and>* (cnode_id, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (tcb_id, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (tcb_id, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (tcb_id, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object tcb_cap = tcb_id \<and> tcb_cap_slot = offset tcb_root root_size \<and> cspace_slot = offset cspace_root root_size \<and> vspace_slot = offset vspace_root root_size \<and> buffer_frame_slot = offset buffer_frame_root root_size\<rbrace> seL4_TCB_Configure tcb_root fault_ep cspace_root cspace_root_data vspace_root vspace_root_data buffer_addr buffer_frame_root \<lbrace>\<lambda>rv. Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* tcb_id \<mapsto>f Tcb new_tcb_fields \<and>* (cnode_id, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cnode_id, cspace_slot) \<mapsto>c cspace_cap \<and>* (cnode_id, vspace_slot) \<mapsto>c vspace_cap \<and>* (cnode_id, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (tcb_id, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (tcb_id, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (tcb_id, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)\<rbrace> proof (prove)
using this:
cnode_id = cap_object cnode_cap \<and> tcb_id = cap_object tcb_cap \<and> offset tcb_root root_size = tcb_cap_slot \<and> offset cspace_root root_size = cspace_slot \<and> offset vspace_root root_size = vspace_slot \<and> offset buffer_frame_root root_size = buffer_frame_slot

goal (1 subgoal):
 1. \<lbrakk>is_pd_cap vspace_cap; is_frame_cap buffer_frame_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; is_tcb root_tcb; is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* tcb_id \<mapsto>f Tcb tcb \<and>* (cnode_id, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cnode_id, cspace_slot) \<mapsto>c cspace_cap \<and>* (cnode_id, vspace_slot) \<mapsto>c vspace_cap \<and>* (cnode_id, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (tcb_id, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (tcb_id, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (tcb_id, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s \<and> cap_object cnode_cap = cnode_id \<and> cap_object cnode_cap' = cnode_id \<and> cap_object tcb_cap = tcb_id \<and> tcb_cap_slot = offset tcb_root root_size \<and> cspace_slot = offset cspace_root root_size \<and> vspace_slot = offset vspace_root root_size \<and> buffer_frame_slot = offset buffer_frame_root root_size\<rbrace> seL4_TCB_Configure tcb_root fault_ep cspace_root cspace_root_data vspace_root vspace_root_data buffer_addr buffer_frame_root \<lbrace>\<lambda>rv. Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cnode_id, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* tcb_id \<mapsto>f Tcb new_tcb_fields \<and>* (cnode_id, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cnode_id, cspace_slot) \<mapsto>c cspace_cap \<and>* (cnode_id, vspace_slot) \<mapsto>c vspace_cap \<and>* (cnode_id, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (tcb_id, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (tcb_id, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (tcb_id, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_pd_cap vspace_cap; is_frame_cap buffer_frame_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; is_tcb root_tcb; is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; cnode_id = cap_object cnode_cap \<and> tcb_id = cap_object tcb_cap \<and> offset tcb_root root_size = tcb_cap_slot \<and> offset cspace_root root_size = cspace_slot \<and> offset vspace_root root_size = vspace_slot \<and> offset buffer_frame_root root_size = buffer_frame_slot\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>rv s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x3 sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb x3; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>rv s. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>rv s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Q117 cdl_tcb sz\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>rv s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R) (kernel_state s)\<rbrace>
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> ?Q117 cdl_tcb sz s proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P121 cdl_tcb sz\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>rv. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)\<rbrace>
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> ?P121 cdl_tcb sz (kernel_state s) proof (prove)
goal (14 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op123 cdl_tcb sz) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr123 cdl_tcb sz \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> = ?intent_extra123 cdl_tcb sz
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?R123 cdl_tcb sz\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ra123 cdl_tcb sz\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R123 cdl_tcb sz\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Rb123 cdl_tcb sz\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 7. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?PIV123 cdl_tcb sz iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb123 cdl_tcb sz s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op123 cdl_tcb sz) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.123 cdl_tcb sz s\<rbrace>
 8. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV123 cdl_tcb sz iv\<rbrace>
 9. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (?intent_op123 cdl_tcb sz) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 10. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id (?intent_extra123 cdl_tcb sz) \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?R123 cdl_tcb sz\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)\<rbrace>
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ra123 cdl_tcb sz\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R123 cdl_tcb sz\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Rb123 cdl_tcb sz\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra123 cdl_tcb sz\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 6. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?PIV123 cdl_tcb sz iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb123 cdl_tcb sz s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.123 cdl_tcb sz s\<rbrace>
 7. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV123 cdl_tcb sz iv\<rbrace>
 8. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 10. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cdl_tcb sz rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* ?R144 cdl_tcb sz) s\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R) s
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ra123 cdl_tcb sz\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R144 cdl_tcb sz)\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Rb123 cdl_tcb sz\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra123 cdl_tcb sz\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 6. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?PIV123 cdl_tcb sz iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb123 cdl_tcb sz s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.123 cdl_tcb sz s\<rbrace>
 7. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV123 cdl_tcb sz iv\<rbrace>
 8. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 10. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ra123 cdl_tcb sz\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R))\<rbrace>
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Rb123 cdl_tcb sz\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra123 cdl_tcb sz\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r _. True\<rbrace>
 5. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?PIV123 cdl_tcb sz iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb123 cdl_tcb sz s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.123 cdl_tcb sz s\<rbrace>
 6. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV123 cdl_tcb sz iv\<rbrace>
 7. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 8. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 9. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?PIV123 cdl_tcb sz iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.123 cdl_tcb sz s\<rbrace>
 2. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV123 cdl_tcb sz iv\<rbrace>
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; \<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'168 cdl_tcb sz iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.123 cdl_tcb sz s\<rbrace>
 2. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'168 cdl_tcb sz iv and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); \<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'168 cdl_tcb sz iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = tcb_root \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [cspace_root, vspace_root, buffer_frame_root] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.123 cdl_tcb sz s\<rbrace>
 2. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'168 cdl_tcb sz iv and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'168 cdl_tcb sz iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = tcb_root \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [cspace_root, vspace_root, buffer_frame_root] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.123 cdl_tcb sz s\<rbrace>
 2. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'168 cdl_tcb sz iv and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'168 cdl_tcb sz iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = tcb_root \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [cspace_root, vspace_root, buffer_frame_root] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.123 cdl_tcb sz s\<rbrace>
 2. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'168 cdl_tcb sz iv and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'168 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = tcb_root \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [cspace_root, vspace_root, buffer_frame_root] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.123 cdl_tcb sz s\<rbrace>
 2. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'168 cdl_tcb sz iv and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'168 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>_ _. False\<rbrace>
 2. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'168 cdl_tcb sz iv and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (9 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'178 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id\<rbrace>, -
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P180 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P180 cdl_tcb sz iv and ?P'178 cdl_tcb sz iv and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 4. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<forall>vcap capref. Some (vspace_cap', cap_object cnode_cap, vspace_slot) = Some (vcap, capref) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<forall>ccap capref. Some (cspace_cap'a, cap_object cnode_cap, cspace_slot) = Some (ccap, capref) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P180 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P180 cdl_tcb sz iv and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (9 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<forall>ccap capref. Some (cspace_cap'a, cap_object cnode_cap, cspace_slot) = Some (ccap, capref) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P180 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P180 cdl_tcb sz iv and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 4. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P180 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 2. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P180 cdl_tcb sz iv and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (9 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'220 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound\<rbrace>, -
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P222 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P222 cdl_tcb sz iv and ?P'220 cdl_tcb sz iv and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 4. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<forall>vcap capref. Some (vspace_cap', cap_object cnode_cap, vspace_slot) = Some (vcap, capref) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<forall>ccap capref. Some (cspace_cap'a, cap_object cnode_cap, cspace_slot) = Some (ccap, capref) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P222 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P222 cdl_tcb sz iv and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (9 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<forall>ccap capref. Some (cspace_cap'a, cap_object cnode_cap, cspace_slot) = Some (ccap, capref) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P222 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P222 cdl_tcb sz iv and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 4. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P222 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>\<lambda>r s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P222 cdl_tcb sz iv and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P222 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))\<rbrace> invoke_tcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<lbrace>?Q259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'\<rbrace>, \<lbrace>?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'\<rbrace>
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?Q259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P222 cdl_tcb sz iv and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<exists>x y z. Some fault_ep = Some (?fltep264 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap') \<and> Some (cspace_cap'a, cap_object cnode_cap, cspace_slot) = Some x \<and> Some (vspace_cap', cap_object cnode_cap, vspace_slot) = Some y \<and> Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot) = Some z \<and> ?crt_slot279 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd x \<and> ?vrt_slot281 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd y \<and> ?ipcbuff_slot275 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd z \<and> is_pd_cap vspace_cap \<and> is_frame_cap buffer_frame_cap \<and> is_cnode_cap (?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) \<and> is_cnode_cap (cdl_update_cnode_cap_data cspace_cap cspace_root_data) \<and> cap_object (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = cap_object (?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (fst x) \<and> reset_cap_asid vspace_cap = reset_cap_asid (fst y) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (fst z)
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* ?ipcbuff_slot275 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* ?vrt_slot281 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* ?crt_slot279 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c ?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := ?fltep264 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* ?vrt_slot281 cdl_tcb sz iv \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* ?crt_slot279 cdl_tcb sz iv \<mapsto>c ?crt_cap'277 cdl_tcb sz iv \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?ipcbuff_slot275 cdl_tcb sz iv \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz iv) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<exists>y z. Some fault_ep = Some (?fltep264 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap') \<and> Some (cspace_cap'a, cap_object cnode_cap, cspace_slot) = Some (invoke_tcb_cspace iv) \<and> Some (vspace_cap', cap_object cnode_cap, vspace_slot) = Some y \<and> Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot) = Some z \<and> ?crt_slot279 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd (invoke_tcb_cspace iv) \<and> ?vrt_slot281 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd y \<and> ?ipcbuff_slot275 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd z \<and> is_pd_cap vspace_cap \<and> is_frame_cap buffer_frame_cap \<and> is_cnode_cap (?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) \<and> is_cnode_cap (cdl_update_cnode_cap_data cspace_cap cspace_root_data) \<and> cap_object (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = cap_object (?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (fst (invoke_tcb_cspace iv)) \<and> reset_cap_asid vspace_cap = reset_cap_asid (fst y) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (fst z)
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* ?ipcbuff_slot275 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* ?vrt_slot281 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* ?crt_slot279 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c ?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := ?fltep264 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* ?vrt_slot281 cdl_tcb sz iv \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* ?crt_slot279 cdl_tcb sz iv \<mapsto>c ?crt_cap'277 cdl_tcb sz iv \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?ipcbuff_slot275 cdl_tcb sz iv \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz iv) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> \<exists>z. Some fault_ep = Some (?fltep264 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap') \<and> Some (cspace_cap'a, cap_object cnode_cap, cspace_slot) = Some (invoke_tcb_cspace iv) \<and> Some (vspace_cap', cap_object cnode_cap, vspace_slot) = Some (invoke_tcb_vspace iv) \<and> Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot) = Some z \<and> ?crt_slot279 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd (invoke_tcb_cspace iv) \<and> ?vrt_slot281 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd (invoke_tcb_vspace iv) \<and> ?ipcbuff_slot275 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd z \<and> is_pd_cap vspace_cap \<and> is_frame_cap buffer_frame_cap \<and> is_cnode_cap (?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) \<and> is_cnode_cap (cdl_update_cnode_cap_data cspace_cap cspace_root_data) \<and> cap_object (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = cap_object (?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (fst (invoke_tcb_cspace iv)) \<and> reset_cap_asid vspace_cap = reset_cap_asid (fst (invoke_tcb_vspace iv)) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (fst z)
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* ?ipcbuff_slot275 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* ?vrt_slot281 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* ?crt_slot279 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c ?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := ?fltep264 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* ?vrt_slot281 cdl_tcb sz iv \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* ?crt_slot279 cdl_tcb sz iv \<mapsto>c ?crt_cap'277 cdl_tcb sz iv \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?ipcbuff_slot275 cdl_tcb sz iv \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz iv) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> Some fault_ep = Some (?fltep264 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap') \<and> Some (cspace_cap'a, cap_object cnode_cap, cspace_slot) = Some (invoke_tcb_cspace iv) \<and> Some (vspace_cap', cap_object cnode_cap, vspace_slot) = Some (invoke_tcb_vspace iv) \<and> Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot) = Some (invoke_tcb_ipcbuffer iv) \<and> ?crt_slot279 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd (invoke_tcb_cspace iv) \<and> ?vrt_slot281 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd (invoke_tcb_vspace iv) \<and> ?ipcbuff_slot275 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) = snd (invoke_tcb_ipcbuffer iv) \<and> is_pd_cap vspace_cap \<and> is_frame_cap buffer_frame_cap \<and> is_cnode_cap (?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) \<and> is_cnode_cap (cdl_update_cnode_cap_data cspace_cap cspace_root_data) \<and> cap_object (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = cap_object (?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (fst (invoke_tcb_cspace iv)) \<and> reset_cap_asid vspace_cap = reset_cap_asid (fst (invoke_tcb_vspace iv)) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (fst (invoke_tcb_ipcbuffer iv))
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* ?ipcbuff_slot275 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* ?vrt_slot281 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* ?crt_slot279 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<mapsto>c ?crt_cap'277 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot)))) \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := ?fltep264 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap'\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* ?vrt_slot281 cdl_tcb sz iv \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* ?crt_slot279 cdl_tcb sz iv \<mapsto>c ?crt_cap'277 cdl_tcb sz iv \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?ipcbuff_slot275 cdl_tcb sz iv \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz iv) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (9 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 3. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz iv) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 4. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz iv) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (update_tcb_fault_endpoint fault_ep tcb) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz iv) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz iv) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz cspace_cap'a vspace_cap' buffer_frame_cap' s x. \<lbrakk>\<not> is_memory_cap (TcbCap x); is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>; \<not> ep_related_cap (TcbCap x); root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); cdl.lift ((x, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap x \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (x, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (x, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* x \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl x (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s; tcb_cap = TcbCap x; reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a; reset_cap_asid vspace_cap = reset_cap_asid vspace_cap'; reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* x \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap x \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (x, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (x, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (x, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz iv) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz cspace_cap'a vspace_cap' buffer_frame_cap' s x. \<lbrakk>\<not> is_memory_cap (TcbCap x); is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>; \<not> ep_related_cap (TcbCap x); root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); cdl.lift ((x, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap x \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (x, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (x, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* x \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl x (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s; tcb_cap = TcbCap x; reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a; reset_cap_asid vspace_cap = reset_cap_asid vspace_cap'; reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* x \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap x \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (x, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (x, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (x, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* R)) s
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))))) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 3. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 4. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R'273 cdl_tcb sz iv) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 5. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (9 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; cdl.lift ((cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c cdl_update_cnode_cap_data cspace_cap cspace_root_data \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* cap_object tcb_cap \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := fault_ep\<rparr>) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s
 2. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 3. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 4. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, cspace_slot)) (Some (vspace_cap', cap_object cnode_cap, vspace_slot)) (Some (buffer_frame_cap', cap_object cnode_cap, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'; ?E259 cdl_tcb sz iv cspace_cap'a vspace_cap' buffer_frame_cap' e s\<rbrakk> \<Longrightarrow> False
 2. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')\<rbrace>
 2. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Ps123 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) s\<rbrace>
 2. \<And>cdl_tcb sz iv rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) s\<rbrakk> \<Longrightarrow> (cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')) s
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>?Ps123 cdl_tcb sz\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P'522 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)\<rbrace>
 2. \<And>cdl_tcb sz iv rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) s\<rbrakk> \<Longrightarrow> (cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')) s
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> ?P'522 cdl_tcb sz iv s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'522 cdl_tcb sz iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)\<rbrace>
 2. \<And>cdl_tcb sz iv rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) s\<rbrakk> \<Longrightarrow> (cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')) s
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> ?P'522 cdl_tcb sz iv s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz iv rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R540 cdl_tcb sz iv) s\<rbrakk> \<Longrightarrow> cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) s
 2. \<And>cdl_tcb sz iv rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) s\<rbrakk> \<Longrightarrow> (cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')) s
 3. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R540 cdl_tcb sz iv) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz iv rv s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) s\<rbrakk> \<Longrightarrow> (cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) and ((\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz iv) \<and>* ?R232 cdl_tcb sz iv)) and ((\<lambda>s. cdl_current_thread s = Some root_tcb_id) and cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz iv) \<and>* ?R190 cdl_tcb sz iv)) and K (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap')) s
 2. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz s cspace_cap'a vspace_cap' buffer_frame_cap'. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl_current_thread s = Some root_tcb_id; cdl_current_domain s = minBound; cdl.lift (cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R) s; reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap'a; reset_cap_asid vspace_cap = reset_cap_asid vspace_cap'; reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb234 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))))) \<and>* ?R232 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))))) s \<and> cdl.lift ((cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* cap_object tcb_cap \<mapsto>f Tcb (?tcb192 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))))) \<and>* ?R190 cdl_tcb sz (InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap'a, cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))))) s
 2. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb sz c ref cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = (InvokeTcb $ ThreadControl (cap_object tcb_cap) (cnode_id, tcb_cap_slot) (Some fault_ep) (Some (cspace_cap', cnode_id, cspace_slot)) (Some (vspace_cap', cnode_id, vspace_slot)) (Some (buffer_frame_cap', cnode_id, buffer_frame_slot))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?Pd123 cdl_tcb sz cs c (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. iv = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?Pd123 cdl_tcb sz xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'710 cdl_tcb sz c cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id\<rbrace>, -
 2. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P711 cdl_tcb sz c cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. r = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?P711 cdl_tcb sz (fst r) xa (snd r) and ?P'710 cdl_tcb sz (fst r) xa (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P711 cdl_tcb sz c cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. r = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?P711 cdl_tcb sz (fst r) xa (snd r) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'724 cdl_tcb sz c cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r s. cdl_current_domain s = minBound\<rbrace>, -
 2. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P725 cdl_tcb sz c cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r s. (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. r = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?P725 cdl_tcb sz (fst r) xa (snd r) and ?P'724 cdl_tcb sz (fst r) xa (snd r) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P725 cdl_tcb sz c cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r s. (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. r = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap') \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?P725 cdl_tcb sz (fst r) xa (snd r) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'736 cdl_tcb sz c cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r s. \<exists>cspace_cap' vspace_cap' buffer_frame_cap'. r = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'\<rbrace>, -
 2. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P737 cdl_tcb sz c cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R))\<rbrace>, \<lbrace>\<lambda>r s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. ?P737 cdl_tcb sz (fst r) xa (snd r) and ?P'736 cdl_tcb sz (fst r) xa (snd r) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'751 cdl_tcb sz c a b cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R))\<rbrace>, \<lbrace>\<lambda>rv s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. (\<lambda>a. (is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id) \<and> ?P'751 cdl_tcb sz (fst r) (fst (snd r)) (snd (snd r)) xa (snd r) a) and (\<lambda>a. is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cnode_id, cspace_slot), (vroot_cap, cnode_id, vspace_slot), (ipcbuff_cap, cnode_id, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. InvokeTcb (ThreadControl (cap_object (fst r)) (snd r) (Some fault_ep) (Some (cdl_update_cnode_cap_data croot_cap cspace_root_data, cnode_id, cspace_slot)) (Some (vroot_cap, cnode_id, vspace_slot)) (Some (reset_mem_mapping ipcbuff_cap, cnode_id, buffer_frame_slot))) = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'))) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>?P'757 cdl_tcb sz c a b cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R))\<rbrace>, \<lbrace>\<lambda>rv s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. (\<lambda>a. (is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id) \<and> (?P'757 cdl_tcb sz (fst r) (fst (snd r)) (snd (snd r)) xa (snd r) and K (is_tcb_cap (fst r))) a) and (\<lambda>a. is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cnode_id, cspace_slot), (vroot_cap, cnode_id, vspace_slot), (ipcbuff_cap, cnode_id, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. InvokeTcb (ThreadControl (cap_object (fst r)) (snd r) (Some fault_ep) (Some (cdl_update_cnode_cap_data croot_cap cspace_root_data, cnode_id, cspace_slot)) (Some (vroot_cap, cnode_id, vspace_slot)) (Some (reset_mem_mapping ipcbuff_cap, cnode_id, buffer_frame_slot))) = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'))) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz c a b cs P. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>rv. P\<rbrace>, \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>?P760 cdl_tcb sz c a b cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R))\<rbrace>, -
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. (\<lambda>a. (is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id) \<and> (?P760 cdl_tcb sz (fst r) (fst (snd r)) (snd (snd r)) xa (snd r) and (\<lambda>a. cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_tcb_cap (fst r))) a) and (\<lambda>a. is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cnode_id, cspace_slot), (vroot_cap, cnode_id, vspace_slot), (ipcbuff_cap, cnode_id, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. InvokeTcb (ThreadControl (cap_object (fst r)) (snd r) (Some fault_ep) (Some (cdl_update_cnode_cap_data croot_cap cspace_root_data, cnode_id, cspace_slot)) (Some (vroot_cap, cnode_id, vspace_slot)) (Some (reset_mem_mapping ipcbuff_cap, cnode_id, buffer_frame_slot))) = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'))) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz c a b cs P. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> liftME InvokeTcb (decode_tcb_invocation c (a, b) cs (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>rv. P\<rbrace>, \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>?P760 cdl_tcb sz c a b cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R))\<rbrace>, -
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. (\<lambda>a. (is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id) \<and> (?P760 cdl_tcb sz (fst r) (fst (snd r)) (snd (snd r)) xa (snd r) and (\<lambda>a. cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_tcb_cap (fst r))) a) and (\<lambda>a. is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cnode_id, cspace_slot), (vroot_cap, cnode_id, vspace_slot), (ipcbuff_cap, cnode_id, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. InvokeTcb (ThreadControl (cap_object (fst r)) (snd r) (Some fault_ep) (Some (cdl_update_cnode_cap_data croot_cap cspace_root_data, cnode_id, cspace_slot)) (Some (vroot_cap, cnode_id, vspace_slot)) (Some (reset_mem_mapping ipcbuff_cap, cnode_id, buffer_frame_slot))) = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'))) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz c a b cs P. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> liftME InvokeTcb (decode_tcb_invocation c (a, b) cs (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>rv. P\<rbrace>, \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>?P760 cdl_tcb sz c a b cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R))\<rbrace>, -
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. (\<lambda>a. (is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id) \<and> (?P760 cdl_tcb sz (fst r) (fst (snd r)) (snd (snd r)) xa (snd r) and (\<lambda>a. cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_tcb_cap (fst r))) a) and (\<lambda>a. is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cnode_id, cspace_slot), (vroot_cap, cnode_id, vspace_slot), (ipcbuff_cap, cnode_id, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. InvokeTcb (ThreadControl (cap_object (fst r)) (snd r) (Some fault_ep) (Some (cdl_update_cnode_cap_data croot_cap cspace_root_data, cnode_id, cspace_slot)) (Some (vroot_cap, cnode_id, vspace_slot)) (Some (reset_mem_mapping ipcbuff_cap, cnode_id, buffer_frame_slot))) = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'))) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz c a b cs P. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> decode_tcb_invocation c (a, b) cs (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr) \<lbrace>(\<lambda>rv. P) \<circ> InvokeTcb\<rbrace>, \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>?P760 cdl_tcb sz c a b cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R))\<rbrace>, -
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. (\<lambda>a. (is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id) \<and> (?P760 cdl_tcb sz (fst r) (fst (snd r)) (snd (snd r)) xa (snd r) and (\<lambda>a. cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_tcb_cap (fst r))) a) and (\<lambda>a. is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cnode_id, cspace_slot), (vroot_cap, cnode_id, vspace_slot), (ipcbuff_cap, cnode_id, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. InvokeTcb (ThreadControl (cap_object (fst r)) (snd r) (Some fault_ep) (Some (cdl_update_cnode_cap_data croot_cap cspace_root_data, cnode_id, cspace_slot)) (Some (vroot_cap, cnode_id, vspace_slot)) (Some (reset_mem_mapping ipcbuff_cap, cnode_id, buffer_frame_slot))) = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'))) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz c a b cs P. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> decode_tcb_invocation c (a, b) cs (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr) \<lbrace>\<lambda>rv. P\<rbrace>, \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>cdl_tcb sz c a b cs. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; is_tcb_cap c\<rbrakk> \<Longrightarrow> \<lbrace>?P760 cdl_tcb sz c a b cs (a, b)\<rbrace> decode_invocation c (a, b) cs (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)) \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R))\<rbrace>, -
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. (\<lambda>a. (is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id) \<and> (?P760 cdl_tcb sz (fst r) (fst (snd r)) (snd (snd r)) xa (snd r) and (\<lambda>a. cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_tcb_cap (fst r))) a) and (\<lambda>a. is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cnode_id, cspace_slot), (vroot_cap, cnode_id, vspace_slot), (ipcbuff_cap, cnode_id, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. InvokeTcb (ThreadControl (cap_object (fst r)) (snd r) (Some fault_ep) (Some (cdl_update_cnode_cap_data croot_cap cspace_root_data, cnode_id, cspace_slot)) (Some (vroot_cap, cnode_id, vspace_slot)) (Some (reset_mem_mapping ipcbuff_cap, cnode_id, buffer_frame_slot))) = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'))) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [cspace_root, vspace_root, buffer_frame_root] \<lbrace>\<lambda>xa. (\<lambda>a. (is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id) \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) and (\<lambda>a. cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_tcb_cap (fst r))) a) and (\<lambda>a. is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cnode_id, cspace_slot), (vroot_cap, cnode_id, vspace_slot), (ipcbuff_cap, cnode_id, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> (\<exists>cspace_cap' vspace_cap' buffer_frame_cap'. InvokeTcb (ThreadControl (cap_object (fst r)) (snd r) (Some fault_ep) (Some (cdl_update_cnode_cap_data croot_cap cspace_root_data, cnode_id, cspace_slot)) (Some (vroot_cap, cnode_id, vspace_slot)) (Some (reset_mem_mapping ipcbuff_cap, cnode_id, buffer_frame_slot))) = InvokeTcb (ThreadControl (cap_object tcb_cap) (cap_object cnode_cap, offset tcb_root root_size) (Some fault_ep) (Some (cspace_cap', cap_object cnode_cap, offset cspace_root root_size)) (Some (vspace_cap', cap_object cnode_cap, offset vspace_root root_size)) (Some (buffer_frame_cap', cap_object cnode_cap, offset buffer_frame_root root_size))) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid cspace_cap' \<and> reset_cap_asid vspace_cap = reset_cap_asid vspace_cap' \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid buffer_frame_cap'))) and (\<lambda>a. cdl_current_domain a = minBound) and (\<lambda>a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id cspace_root;
xa <- lookup_cap_and_slot root_tcb_id vspace_root;
xb <- lookup_cap_and_slot root_tcb_id buffer_frame_root;
returnOk [x, xa, xb]
odE \<lbrace>\<lambda>xa s. is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cap_object cnode_cap, cspace_slot), (vroot_cap, cap_object cnode_cap, vspace_slot), (ipcbuff_cap, cap_object cnode_cap, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> cap_object (fst r) = cap_object tcb_cap \<and> snd r = (cap_object cnode_cap, tcb_cap_slot) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid vspace_cap = reset_cap_asid vroot_cap \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ipcbuff_cap)) \<and> cdl_current_domain s = minBound \<and> is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb sz r ra. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?P'776 cdl_tcb sz r ra\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id vspace_root;
xa <- lookup_cap_and_slot root_tcb_id buffer_frame_root;
returnOk [ra, x, xa]
odE \<lbrace>\<lambda>xa s. is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cap_object cnode_cap, cspace_slot), (vroot_cap, cap_object cnode_cap, vspace_slot), (ipcbuff_cap, cap_object cnode_cap, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> cap_object (fst r) = cap_object tcb_cap \<and> snd r = (cap_object cnode_cap, tcb_cap_slot) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid vspace_cap = reset_cap_asid vroot_cap \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ipcbuff_cap)) \<and> cdl_current_domain s = minBound \<and> is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id cspace_root \<lbrace>?P'776 cdl_tcb sz r\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz r ra rb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?P'779 cdl_tcb sz r ra rb\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id buffer_frame_root;
returnOk [ra, rb, x]
odE \<lbrace>\<lambda>xa s. is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cap_object cnode_cap, cspace_slot), (vroot_cap, cap_object cnode_cap, vspace_slot), (ipcbuff_cap, cap_object cnode_cap, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> cap_object (fst r) = cap_object tcb_cap \<and> snd r = (cap_object cnode_cap, tcb_cap_slot) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid vspace_cap = reset_cap_asid vroot_cap \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ipcbuff_cap)) \<and> cdl_current_domain s = minBound \<and> is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz r ra. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?P'776 cdl_tcb sz r ra\<rbrace> lookup_cap_and_slot root_tcb_id vspace_root \<lbrace>?P'779 cdl_tcb sz r ra\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id cspace_root \<lbrace>?P'776 cdl_tcb sz r\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz r ra rb rc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?P'782 cdl_tcb sz r ra rb rc\<rbrace> returnOk [ra, rb, rc] \<lbrace>\<lambda>xa s. is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. xa = [(croot_cap, cap_object cnode_cap, cspace_slot), (vroot_cap, cap_object cnode_cap, vspace_slot), (ipcbuff_cap, cap_object cnode_cap, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> cap_object (fst r) = cap_object tcb_cap \<and> snd r = (cap_object cnode_cap, tcb_cap_slot) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid vspace_cap = reset_cap_asid vroot_cap \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ipcbuff_cap)) \<and> cdl_current_domain s = minBound \<and> is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz r ra rb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?P'779 cdl_tcb sz r ra rb\<rbrace> lookup_cap_and_slot root_tcb_id buffer_frame_root \<lbrace>?P'782 cdl_tcb sz r ra rb\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz r ra. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?P'776 cdl_tcb sz r ra\<rbrace> lookup_cap_and_slot root_tcb_id vspace_root \<lbrace>?P'779 cdl_tcb sz r ra\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id cspace_root \<lbrace>?P'776 cdl_tcb sz r\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz r ra rb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?P'779 cdl_tcb sz r ra rb\<rbrace> lookup_cap_and_slot root_tcb_id buffer_frame_root \<lbrace>\<lambda>rc a. is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. [ra, rb, rc] = [(croot_cap, cap_object cnode_cap, cspace_slot), (vroot_cap, cap_object cnode_cap, vspace_slot), (ipcbuff_cap, cap_object cnode_cap, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> cap_object (fst r) = cap_object tcb_cap \<and> snd r = (cap_object cnode_cap, tcb_cap_slot) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid vspace_cap = reset_cap_asid vroot_cap \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ipcbuff_cap)) \<and> cdl_current_domain a = minBound \<and> is_tcb_cap (fst r) \<and> cdl_current_thread a = Some root_tcb_id\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz r ra. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?P'776 cdl_tcb sz r ra\<rbrace> lookup_cap_and_slot root_tcb_id vspace_root \<lbrace>?P'779 cdl_tcb sz r ra\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id cspace_root \<lbrace>?P'776 cdl_tcb sz r\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb sz r ra. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?P'776 cdl_tcb sz r ra\<rbrace> lookup_cap_and_slot root_tcb_id vspace_root \<lbrace>\<lambda>rb s. (\<forall>c. reset_cap_asid c = reset_cap_asid buffer_frame_cap \<longrightarrow> is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. [ra, rb, (c, cap_object cnode_cap, offset buffer_frame_root root_size)] = [(croot_cap, cap_object cnode_cap, cspace_slot), (vroot_cap, cap_object cnode_cap, vspace_slot), (ipcbuff_cap, cap_object cnode_cap, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> cap_object (fst r) = cap_object tcb_cap \<and> snd r = (cap_object cnode_cap, tcb_cap_slot) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid vspace_cap = reset_cap_asid vroot_cap \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ipcbuff_cap)) \<and> cdl_current_domain s = minBound \<and> is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R788 cdl_tcb sz r ra rb) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id cspace_root \<lbrace>?P'776 cdl_tcb sz r\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb sz r. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz (fst r) (snd r)\<rbrace> lookup_cap_and_slot root_tcb_id cspace_root \<lbrace>\<lambda>ra s. (\<forall>c. reset_cap_asid c = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid buffer_frame_cap \<longrightarrow> is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> is_tcb_cap (fst r) \<and> (\<exists>croot_cap vroot_cap ipcbuff_cap. [ra, (c, cap_object cnode_cap, offset vspace_root root_size), (ca, cap_object cnode_cap, offset buffer_frame_root root_size)] = [(croot_cap, cap_object cnode_cap, cspace_slot), (vroot_cap, cap_object cnode_cap, vspace_slot), (ipcbuff_cap, cap_object cnode_cap, buffer_frame_slot)] \<and> cap_has_object (fst r) \<and> cap_object (fst r) = cap_object tcb_cap \<and> snd r = (cap_object cnode_cap, tcb_cap_slot) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid vspace_cap = reset_cap_asid vroot_cap \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ipcbuff_cap)) \<and> cdl_current_domain s = minBound \<and> is_tcb_cap (fst r) \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R788 cdl_tcb sz r ra (c, cap_object cnode_cap, offset vspace_root root_size)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R789 cdl_tcb sz r ra) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb sz a aa b. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.123 cdl_tcb sz a (aa, b)\<rbrace> lookup_cap_and_slot root_tcb_id cspace_root \<lbrace>\<lambda>r s. (\<forall>c. reset_cap_asid c = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid buffer_frame_cap \<longrightarrow> is_tcb_cap a \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> is_tcb_cap a \<and> (\<exists>croot_cap. r = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> cap_has_object a \<and> cap_object a = cap_object tcb_cap \<and> aa = cap_object cnode_cap \<and> b = offset tcb_root root_size \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping c)) \<and> cdl_current_domain s = minBound \<and> is_tcb_cap a \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R788 cdl_tcb sz (a, aa, b) r (c, cap_object cnode_cap, offset vspace_root root_size)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R789 cdl_tcb sz (a, aa, b) r) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ?Pd1.123 cdl_tcb sz (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb sz a aa b. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; a = tcb_cap \<and> (aa, b) = (cap_object cnode_cap, offset tcb_root root_size)\<rbrakk> \<Longrightarrow> \<lbrace>?P'811 cdl_tcb sz a (aa, b)\<rbrace> lookup_cap_and_slot root_tcb_id cspace_root \<lbrace>\<lambda>r s. (\<forall>c. reset_cap_asid c = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid buffer_frame_cap \<longrightarrow> is_tcb_cap a \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> is_tcb_cap a \<and> (\<exists>croot_cap. r = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> cap_has_object a \<and> cap_object a = cap_object tcb_cap \<and> aa = cap_object cnode_cap \<and> b = offset tcb_root root_size \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping c)) \<and> cdl_current_domain s = minBound \<and> is_tcb_cap a \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R788 cdl_tcb sz (a, aa, b) r (c, cap_object cnode_cap, offset vspace_root root_size)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R789 cdl_tcb sz (a, aa, b) r) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. (?P'811 cdl_tcb sz (fst r) (snd r) and K (fst r = tcb_cap \<and> snd r = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'811 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size)\<rbrace> lookup_cap_and_slot root_tcb_id cspace_root \<lbrace>\<lambda>r s. (\<forall>c. reset_cap_asid c = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> (\<exists>croot_cap. r = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping c)) \<and> cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) r (c, cap_object cnode_cap, offset vspace_root root_size)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) r) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. (?P'811 cdl_tcb sz (fst r) (snd r) and K (fst r = tcb_cap \<and> snd r = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (4 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.123 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ((\<lambda>a. (\<forall>c. reset_cap_asid c = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst r) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst r), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd r \<mapsto>c TcbCap (cap_object (fst r)) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst r), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst r), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (c, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ca)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst r) (snd r) c ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst r) (snd r) c) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst r) (snd r)) a) and K (fst r = tcb_cap \<and> snd r = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 3. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?Q830 cdl_tcb sz\<rbrace> lookup_cap_and_slot root_tcb_id tcb_root \<lbrace>\<lambda>r s. ((\<lambda>a. (\<forall>c. reset_cap_asid c = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst r) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst r), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd r \<mapsto>c TcbCap (cap_object (fst r)) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst r), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst r), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (c, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ca)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst r) (snd r) c ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst r) (snd r) c) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst r) (snd r)) a) and K (fst r = tcb_cap \<and> snd r = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> ?Q830 cdl_tcb sz s
 3. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (4 subgoals):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.123 cdl_tcb sz\<rbrace>
 3. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?Pd2.123 cdl_tcb sz s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (4 subgoals):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?P834 cdl_tcb sz s; cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s
 2. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. ?P834 cdl_tcb sz s \<and> cdl_current_domain s = minBound\<rbrace>
 3. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ?P834 cdl_tcb sz s \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrace>
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 3. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz)\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = tcb_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object c \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object c, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c TcbCap (cap_object c) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object c, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object c, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data ca cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb) \<and> cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz c (cap_object cnode_cap, tcb_cap_slot) ca cb) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz c (cap_object cnode_cap, tcb_cap_slot) ca) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz c (cap_object cnode_cap, tcb_cap_slot)) s \<and> c = tcb_cap \<and> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s \<and> cdl_current_domain s = minBound\<rbrace>
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 3. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P123 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = tcb_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object c \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object c, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object c) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object c, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object c, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data ca cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb) \<and> cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz c (cap_object cnode_cap, offset tcb_root root_size) ca cb) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz c (cap_object cnode_cap, offset tcb_root root_size) ca) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz c (cap_object cnode_cap, offset tcb_root root_size)) s \<and> c = tcb_cap \<and> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s \<and> cdl_current_domain s = minBound\<rbrace>
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 3. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P123 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz c ca cb cc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P888 cdl_tcb sz c ca cb cc\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object c \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object c, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object c) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object c, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object c, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R))\<rbrace>
 2. \<And>cdl_tcb sz c ca cb cc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'888 cdl_tcb sz c ca cb cc\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data ca cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cc) \<and> cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrace>
 3. \<And>cdl_tcb sz c ca cb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'882 cdl_tcb sz c ca cb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz c (cap_object cnode_cap, offset tcb_root root_size) ca cb)\<rbrace>
 4. \<And>cdl_tcb sz c ca. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'876 cdl_tcb sz c ca\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz c (cap_object cnode_cap, offset tcb_root root_size) ca)\<rbrace>
 5. \<And>cdl_tcb sz c. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'868 cdl_tcb sz c\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz c (cap_object cnode_cap, offset tcb_root root_size)) s \<and> c = tcb_cap \<and> \<not> ep_related_cap c\<rbrace>
 6. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'858 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s \<and> cdl_current_domain s = minBound\<rbrace>
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> tcb_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid cspace_cap \<or> (\<forall>xb. reset_cap_asid xb \<noteq> reset_cap_asid vspace_cap \<or> (\<forall>xc. reset_cap_asid xc \<noteq> reset_cap_asid buffer_frame_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> ?P888 cdl_tcb sz x xa xb xc (kernel_state s) \<and> ?P'888 cdl_tcb sz x xa xb xc (kernel_state s)) \<and> ?P'882 cdl_tcb sz x xa xb (kernel_state s)) \<and> ?P'876 cdl_tcb sz x xa (kernel_state s)) \<and> ?P'868 cdl_tcb sz x (kernel_state s)) \<and> ?P'858 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb sz c ca cb cc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'888 cdl_tcb sz c ca cb cc\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data ca cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cc) \<and> cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id\<rbrace>
 2. \<And>cdl_tcb sz c ca cb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'882 cdl_tcb sz c ca cb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz c (cap_object cnode_cap, offset tcb_root root_size) ca cb)\<rbrace>
 3. \<And>cdl_tcb sz c ca. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'876 cdl_tcb sz c ca\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz c (cap_object cnode_cap, offset tcb_root root_size) ca)\<rbrace>
 4. \<And>cdl_tcb sz c. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'868 cdl_tcb sz c\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz c (cap_object cnode_cap, offset tcb_root root_size)) s \<and> c = tcb_cap \<and> \<not> ep_related_cap c\<rbrace>
 5. \<And>cdl_tcb sz. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size\<rbrakk> \<Longrightarrow> \<lbrace>?P'858 cdl_tcb sz\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s \<and> cdl_current_domain s = minBound\<rbrace>
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> tcb_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid cspace_cap \<or> (\<forall>xb. reset_cap_asid xb \<noteq> reset_cap_asid vspace_cap \<or> (\<forall>xc. reset_cap_asid xc \<noteq> reset_cap_asid buffer_frame_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object x \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object x, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object x) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object x, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object x, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) (kernel_state s) \<and> ?P'888 cdl_tcb sz x xa xb xc (kernel_state s)) \<and> ?P'882 cdl_tcb sz x xa xb (kernel_state s)) \<and> ?P'876 cdl_tcb sz x xa (kernel_state s)) \<and> ?P'868 cdl_tcb sz x (kernel_state s)) \<and> ?P'858 cdl_tcb sz (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> tcb_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid cspace_cap \<or> (\<forall>xb. reset_cap_asid xb \<noteq> reset_cap_asid vspace_cap \<or> (\<forall>xb. reset_cap_asid xb \<noteq> reset_cap_asid buffer_frame_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object x \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object x, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object x) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object x, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object x, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) (kernel_state s) \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data xa cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xb) \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s) \<and> x = tcb_cap \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s) \<and> cdl_current_domain (kernel_state s) = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, tcb_cap_slot) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s) \<and> cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer_addr)), cdl_intent_error = False, cdl_intent_cap = tcb_root, cdl_intent_extras = [cspace_root, vspace_root, buffer_frame_root], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> tcb_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid cspace_cap \<or> (\<forall>xb. reset_cap_asid xb \<noteq> reset_cap_asid vspace_cap \<or> (\<forall>xb. reset_cap_asid xb \<noteq> reset_cap_asid buffer_frame_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object x \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object x, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object x) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object x, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object x, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) (kernel_state s) \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data xa cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xb) \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s) \<and> x = tcb_cap \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s) \<and> cdl_current_domain (kernel_state s) = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x = tcb_cap \<longrightarrow> (\<forall>xa. reset_cap_asid xa = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>xb. reset_cap_asid xb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>xb. reset_cap_asid xb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object x \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object x, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object x) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object x, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object x, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data xa cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xb)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s) \<and> x = tcb_cap \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (12 subgoals):
 1. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object x \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object x, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object x) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object x, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object x, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) (kernel_state s)
 2. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s)
 3. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data xa cspace_root_data)
 4. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xc)
 5. \<And>cdl_tcb sz s x xa xb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)
 6. \<And>cdl_tcb sz s x xa. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)
 7. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s)
 8. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> x = tcb_cap
 9. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (12 subgoals):
 1. \<And>cdl_tcb sz s xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) (kernel_state s)
 2. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s)
 3. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data xa cspace_root_data)
 4. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xc)
 5. \<And>cdl_tcb sz s x xa xb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)
 6. \<And>cdl_tcb sz s x xa. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)
 7. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s)
 8. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> x = tcb_cap
 9. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (12 subgoals):
 1. \<And>cdl_tcb sz s xb xc sa sb sc sd se sf sg sh si sj sk sl sm sn so. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cap_object cnode_cap' = cap_object cnode_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; ((cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap) so\<rbrakk> \<Longrightarrow> ((cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap)) so
 2. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s)
 3. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data xa cspace_root_data)
 4. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xc)
 5. \<And>cdl_tcb sz s x xa xb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)
 6. \<And>cdl_tcb sz s x xa. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)
 7. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s)
 8. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> x = tcb_cap
 9. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (11 subgoals):
 1. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s)
 2. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data xa cspace_root_data)
 3. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xc)
 4. \<And>cdl_tcb sz s x xa xb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)
 5. \<And>cdl_tcb sz s x xa. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)
 6. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s)
 7. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> x = tcb_cap
 8. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data xa cspace_root_data)
 2. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xc)
 3. \<And>cdl_tcb sz s x xa xb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)
 4. \<And>cdl_tcb sz s x xa. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)
 5. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s)
 6. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> x = tcb_cap
 7. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (9 subgoals):
 1. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid xc = reset_cap_asid buffer_frame_cap\<rbrakk> \<Longrightarrow> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xc)
 2. \<And>cdl_tcb sz s x xa xb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)
 3. \<And>cdl_tcb sz s x xa. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)
 4. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s)
 5. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> x = tcb_cap
 6. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (10 subgoals):
 1. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap\<rbrakk> \<Longrightarrow> is_frame_cap buffer_frame_cap
 2. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xc)\<rbrakk> \<Longrightarrow> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xc)
 3. \<And>cdl_tcb sz s x xa xb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)
 4. \<And>cdl_tcb sz s x xa. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)
 5. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s)
 6. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> x = tcb_cap
 7. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
 10. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (9 subgoals):
 1. \<And>cdl_tcb sz s x xa xb xc. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap; reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xc)\<rbrakk> \<Longrightarrow> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping xc)
 2. \<And>cdl_tcb sz s x xa xb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)
 3. \<And>cdl_tcb sz s x xa. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)
 4. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s)
 5. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> x = tcb_cap
 6. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
 9. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb sz s x xa xb. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap; reset_cap_asid xb = reset_cap_asid vspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa xb) (kernel_state s)
 2. \<And>cdl_tcb sz s x xa. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap; reset_cap_asid xa = reset_cap_asid cspace_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size) xa) (kernel_state s)
 3. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz x (cap_object cnode_cap, offset tcb_root root_size)) (kernel_state s)
 4. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> x = tcb_cap
 5. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 6. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
 7. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
 8. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* ?R829 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca cb) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* ?R828 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size)) ca) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* ?R827 cdl_tcb sz (fst (c, cap_object cnode_cap, offset tcb_root root_size)) (snd (c, cap_object cnode_cap, offset tcb_root root_size))) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s
flex-flex pairs:
\<lambda>cdl_tcb sz. ?R829 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c ca. ?R788 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) (ca, cap_object cnode_cap, offset vspace_root root_size)
\<lambda>cdl_tcb sz. ?R828 cdl_tcb sz tcb_cap (cap_object cnode_cap, offset tcb_root root_size) \<equiv>\<^sup>? \<lambda>cdl_tcb sz c. ?R789 cdl_tcb sz (tcb_cap, cap_object cnode_cap, offset tcb_root root_size) (c, cap_object cnode_cap, offset cspace_root root_size) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> x = tcb_cap
 2. \<And>cdl_tcb sz s x. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = tcb_cap\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 3. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
 4. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
 5. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) (kernel_state s)
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
 3. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* ?R833 cdl_tcb sz) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) (kernel_state s); cap_object cnode_cap' = cap_object cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s)
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; \<not> ep_related_cap tcb_cap; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; offset tcb_root root_size = tcb_cap_slot; offset cspace_root root_size = cspace_slot; offset vspace_root root_size = vspace_slot; offset buffer_frame_root root_size = buffer_frame_slot; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); True; ((\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> ((\<lambda>a. (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid vspace_cap \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread a = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) a \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> (\<exists>croot_cap. (ca, cap_object cnode_cap, offset cspace_root root_size) = (croot_cap, cap_object cnode_cap, offset cspace_root root_size) \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data croot_cap cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb)) \<and> cdl_current_domain a = minBound \<and> cdl_current_thread a = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)) \<mapsto>f Tcb tcb \<and>* snd (c, cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c fst (c, cap_object cnode_cap, offset tcb_root root_size) \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object (fst (c, cap_object cnode_cap, offset tcb_root root_size)), tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) a) and K (fst (c, cap_object cnode_cap, offset tcb_root root_size) = tcb_cap \<and> snd (c, cap_object cnode_cap, offset tcb_root root_size) = (cap_object cnode_cap, offset tcb_root root_size))) s \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_root root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, cspace_slot) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, vspace_slot) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, buffer_frame_slot) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s) \<and> cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; \<forall>c. reset_cap_asid c = tcb_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid cspace_cap \<longrightarrow> ((\<exists>c. reset_cap_asid c = reset_cap_asid vspace_cap) \<longrightarrow> (\<forall>cb. reset_cap_asid cb = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object c \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object c, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object c) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object c, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object c, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data ca cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping cb) \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object c \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object c, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object c, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object c, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object c \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object c, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object c, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object c, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object c \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c c \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object c, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object c, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object c, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s \<and> c = tcb_cap \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_domain s = minBound\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_domain s = minBound; reset_cap_asid tcb_cap = tcb_cap \<longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid cspace_cap \<longrightarrow> ((\<exists>c. reset_cap_asid c = reset_cap_asid vspace_cap) \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data c cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ca) \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s \<and> tcb_cap = tcb_cap \<and> \<not> ep_related_cap tcb_cap\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_domain s = minBound; \<forall>c. reset_cap_asid c = reset_cap_asid cspace_cap \<longrightarrow> ((\<exists>c. reset_cap_asid c = reset_cap_asid vspace_cap) \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> reset_cap_asid (cdl_update_cnode_cap_data cspace_cap cspace_root_data) = reset_cap_asid (cdl_update_cnode_cap_data c cspace_root_data) \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping ca) \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; \<not> ep_related_cap tcb_cap\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_domain s = minBound; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; \<not> ep_related_cap tcb_cap; (\<exists>c. reset_cap_asid c = reset_cap_asid vspace_cap) \<longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping c) \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_domain s = minBound; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; \<not> ep_related_cap tcb_cap; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; (\<forall>c. reset_cap_asid c = reset_cap_asid buffer_frame_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping c) \<and> cdl_current_thread s = Some root_tcb_id) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_domain s = minBound; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; \<not> ep_related_cap tcb_cap; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_thread s = Some root_tcb_id; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s; reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping buffer_frame_cap); cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_domain s = minBound; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; \<not> ep_related_cap tcb_cap; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s; reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping buffer_frame_cap); cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_domain s = minBound; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; \<not> ep_related_cap tcb_cap; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s; reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping buffer_frame_cap); cdl_current_thread s = Some root_tcb_id\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R1489 cdl_tcb sz s) s
 2. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_domain s = minBound; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; \<not> ep_related_cap tcb_cap; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s; reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping buffer_frame_cap); cdl_current_thread s = Some root_tcb_id; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* ?R1489 cdl_tcb sz s) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl_current_domain s = minBound; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; \<not> ep_related_cap tcb_cap; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s; reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping buffer_frame_cap); cdl_current_thread s = Some root_tcb_id; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb sz s. \<lbrakk>is_tcb_cap tcb_cap; \<not> is_memory_cap tcb_cap; is_pd_cap vspace_cap; is_cnode_cap cspace_cap; is_cnode_cap cnode_cap; buffer_addr \<noteq> 0; cap_has_object tcb_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_root word_bits; guard_equal cnode_cap cspace_root word_bits; guard_equal cnode_cap vspace_root word_bits; guard_equal cnode_cap buffer_frame_root word_bits; cspace_cap' = update_cap_data_det cspace_root_data cspace_cap; new_tcb_fields = update_tcb_fault_endpoint fault_ep tcb; cnode_id = cap_object cnode_cap; tcb_id = cap_object tcb_cap; root_tcb = Tcb cdl_tcb; cap_type buffer_frame_cap = Some (FrameType sz); tcb_cap_slot = offset tcb_root root_size; cspace_slot = offset cspace_root root_size; vspace_slot = offset vspace_root root_size; buffer_frame_slot = offset buffer_frame_root root_size; cdl_current_domain s = minBound; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap cspace_root \<mapsto>u cspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; \<not> ep_related_cap tcb_cap; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap vspace_root \<mapsto>u vspace_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap buffer_frame_root \<mapsto>u buffer_frame_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c tcb_cap \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s; reset_cap_asid buffer_frame_cap = reset_cap_asid (reset_mem_mapping buffer_frame_cap); cdl_current_thread s = Some root_tcb_id; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset tcb_root root_size) \<mapsto>c TcbCap (cap_object tcb_cap) \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* R)) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_root \<mapsto>u tcb_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (cap_object cnode_cap, cnode_cap_slot) \<mapsto>c cnode_cap' \<and>* cap_object tcb_cap \<mapsto>f Tcb tcb \<and>* (cap_object cnode_cap, offset cspace_root root_size) \<mapsto>c cspace_cap \<and>* (cap_object cnode_cap, offset vspace_root root_size) \<mapsto>c vspace_cap \<and>* (cap_object cnode_cap, offset buffer_frame_root root_size) \<mapsto>c buffer_frame_cap \<and>* (cap_object tcb_cap, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) s proof (prove)
goal:
No subgoals!