theory IRQ_DP

lemma seL4_IRQHandler_SetEndpoint_wp_helper:
 assumes unify : "irq_cap = IrqHandlerCap irq \<and>
                  offset endpoint_cptr root_size = irq_handler_slot \<and> endpoint_ptr = (cnode_id, irq_handler_slot) \<and>
                  irq_ptr = (cnode_id, offset irq_handler_cap root_size) \<and>
                  root_tcb  = Tcb t \<and>
                  cnode_id = cap_object cnode_cap"

shows "\<lbrace>\<guillemotleft>root_tcb_id \<mapsto>f root_tcb  \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>*
         cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap  \<and>* (endpoint_ptr) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R \<guillemotright>
              and K (\<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> \<not>is_untyped_cap endpoint_cap \<and> \<not>is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and>
              guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and>
              guard_equal cnode_cap irq_handler_cap word_bits \<and>
              is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap  )\<rbrace>
        seL4_IRQHandler_SetEndpoint irq_handler_cap endpoint_cptr
        \<lbrace>\<lambda>fail s. \<guillemotleft> root_tcb_id \<mapsto>f root_tcb \<and>*
       (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>*

       \<comment> \<open>Root CNode.\<close>
       cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>*
       \<comment> \<open>Cap to the root CNode.\<close>
       (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>*
       (endpoint_ptr) \<mapsto>c endpoint_cap \<and>*
       irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R\<guillemotright> s\<rbrace>" apply (simp add: seL4_IRQHandler_SetEndpoint_def sep_state_projection2_def) apply (rule hoare_pre) apply (wp do_kernel_op_pull_back) apply (rule call_kernel_with_intent_allow_error_helper
                [where check = True and Perror = \<top> and intent_op = "(IrqHandlerIntent IrqHandlerSetEndpointIntent)" and tcb = t and intent_cptr = irq_handler_cap and intent_extra = "[endpoint_cptr]" ,simplified]) apply (clarsimp) apply (rule set_cap_wp[sep_wand_wp]) apply (rule mark_tcb_intent_error_sep_inv) apply (wp (once)) apply (rule corrupt_ipc_buffer_sep_inv) apply (wp (once)) apply (rule_tac P = "(iv = (InvokeIrqHandler $ SetIrqHandler (the $ cdl_cap_irq irq_cap) endpoint_cap endpoint_ptr))" in  hoare_gen_asmEx) apply (clarsimp) apply (wp) apply (wp sep_wp: invoke_irq_handler_set_handler_wp) apply (wp sep_wp: set_cap_wp) apply (rule_tac P = "c=irq_cap" in hoare_gen_asmEx, simp) apply (simp add: unify decode_invocation_def) apply (wp) apply (rule_tac P = "x = (IrqHandlerSetEndpointIntent)" in hoare_gen_asmE, simp) apply (wp decode_invocation_irq_endpoint_rv'[where endpoint_cap=endpoint_cap and endpoint_ptr = endpoint_ptr and xs = "[]"]) apply (unfold throw_opt_def get_irq_handler_intent_def, simp) apply (rule returnOk_wp) apply (rule lookup_extra_caps_once_wp[where cap'=endpoint_cap and r=root_size]) apply (rule lookup_cap_and_slot_rvu[where cap'=irq_cap and r=root_size]) apply (wp hoare_vcg_ball_lift hoare_vcg_imp_lift hoare_vcg_ex_lift hoare_vcg_all_lift update_thread_intent_update) apply (clarsimp) apply (rule conjI) apply (erule allE impE)+ apply fastforce apply (erule conjE allE impE)+ apply (fastforce) apply (clarsimp) apply (rule conjI) apply (erule allE impE)+ apply fastforce apply (erule conjE allE impE)+ apply (fastforce) apply (clarsimp) apply (sep_solve) apply (clarsimp) apply (intro impI conjI) apply (clarsimp simp: unify) apply (intro impI conjI allI) apply (sep_solve) apply (sep_cancel)+ apply (intro impI conjI allI) apply (sep_cancel)+ apply (frule reset_cap_cdl_cap_irq ) apply (clarsimp simp: unify ) apply (sep_cancel)+ apply (safe) apply (sep_solve) apply (sep_cancel)+ apply (erule sep_map_c_asid_reset'' ) apply (clarsimp simp: unify the_def ) apply (clarsimp simp: unify) apply (clarsimp simp: not_memory_reset) apply (fastforce) defer apply (clarsimp simp: user_pointer_at_def Let_unfold sep_conj_assoc unify) apply (sep_cancel)+ apply (metis ep_related_cap_reset_simp) apply (sep_cancel)+ apply (clarsimp simp: user_pointer_at_def Let_unfold sep_conj_assoc unify) apply sep_solve apply (clarsimp simp: unify) apply sep_solve apply (clarsimp dest!: reset_cap_asid_simps2) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) and K (\<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)\<rbrace> seL4_IRQHandler_SetEndpoint irq_handler_cap endpoint_cptr \<lbrace>\<lambda>fail. Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>fail s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> True) \<lbrace>\<lambda>fail s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)\<rbrace>
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> ?Q s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P4\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> True \<lbrace>\<lambda>fail. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)\<rbrace>
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> ?P4 (kernel_state s) proof (prove)
goal (14 subgoals):
 1. cdl_intent_op \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> = irq_handler_cap \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> = [endpoint_cptr]
 2. \<lbrace>?R6\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>fail. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)\<rbrace>
 3. \<lbrace>?Ra6\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>fail. ?R6\<rbrace>
 4. \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 5. \<lbrace>?Rb6\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail. ?Ra6\<rbrace>
 6. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 7. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb6 s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 8. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 9. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 10. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<lbrace>?R6\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>fail. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)\<rbrace>
 2. \<lbrace>?Ra6\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>fail. ?R6\<rbrace>
 3. \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 4. \<lbrace>?Rb6\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail. ?Ra6\<rbrace>
 5. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 6. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb6 s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 7. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 8. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 10. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrace>?Ra6\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>fail. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R))\<rbrace>
 2. \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 3. \<lbrace>?Rb6\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail. ?Ra6\<rbrace>
 4. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 5. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb6 s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 6. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 7. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 8. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 9. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<lbrace>\<lambda>_. True\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 2. \<lbrace>?Rb6\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R))\<rbrace>
 3. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 4. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb6 s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 5. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 6. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 7. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 8. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 10. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<lbrace>?Rb6\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R))\<rbrace>
 2. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 3. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb6 s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 4. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 5. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 7. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 9. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 10. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (9 subgoals):
 1. \<lbrace>\<lambda>_. True\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>fail _. True\<rbrace>
 2. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 3. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 4. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 6. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 8. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 9. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>iv. \<lbrace>?PIV6 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?PIV6 iv\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 5. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 7. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 8. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>iv. iv = (InvokeIrqHandler $ SetIrqHandler (the $ cdl_cap_irq irq_cap) endpoint_cap endpoint_ptr) \<Longrightarrow> \<lbrace>?P'32 iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>fail s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.6 s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?P'32 iv and K (iv = (InvokeIrqHandler $ SetIrqHandler (the $ cdl_cap_irq irq_cap) endpoint_cap endpoint_ptr))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 5. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 7. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 8. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<lbrace>?P'32 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))\<rbrace> invoke_irq_handler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)) s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. ?P'32 iv and K (iv = (InvokeIrqHandler $ SetIrqHandler (the $ cdl_cap_irq irq_cap) endpoint_cap endpoint_ptr))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 5. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 7. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 8. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<lbrace>?P'41 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))\<rbrace> invoke_irq_handler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)) s\<rbrace>
 2. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> ?P'41 iv a) and K (iv = (InvokeIrqHandler $ SetIrqHandler (the $ cdl_cap_irq irq_cap) endpoint_cap endpoint_ptr))\<rbrace>
 3. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 5. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 7. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 8. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>iv. \<lbrace>?Ps6 iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>fail. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj58 iv \<and>* (?obj57 iv, 0) \<mapsto>c ?cap'56 iv) \<and>* (the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj55 iv \<and>* (?obj54 iv, 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)) a)) and K (\<not> ep_related_cap (?cap'53 iv) \<and> cap_type endpoint_cap \<noteq> Some UntypedType)) a) and K (iv = (InvokeIrqHandler $ SetIrqHandler (the $ cdl_cap_irq irq_cap) endpoint_cap endpoint_ptr))\<rbrace>
 2. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>?Ps6\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 4. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 6. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 7. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. \<lbrace>?Pd6 cs c ref\<rbrace> decode_invocation c ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj58 iv \<and>* (?obj57 iv, 0) \<mapsto>c ?cap'56 iv) \<and>* (the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj55 iv \<and>* (?obj54 iv, 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)) a)) and K (\<not> ep_related_cap (?cap'53 iv) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> K (iv = (InvokeIrqHandler $ SetIrqHandler (the $ cdl_cap_irq irq_cap) endpoint_cap endpoint_ptr)) s\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?Pd6 xa (fst fail) (snd fail)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 3. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 5. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. c = irq_cap \<Longrightarrow> \<lbrace>?P'96 irq_cap ref cs\<rbrace> decode_invocation irq_cap ref cs (IrqHandlerIntent IrqHandlerSetEndpointIntent) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj58 iv \<and>* (?obj57 iv, 0) \<mapsto>c ?cap'56 iv) \<and>* (the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj55 iv \<and>* (?obj54 iv, 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'53 iv) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> iv = InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?P'96 (fst fail) (snd fail) xa and K (fst fail = irq_cap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 3. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 5. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. c = IrqHandlerCap irq \<Longrightarrow> \<lbrace>?P'96 (IrqHandlerCap irq) ref cs\<rbrace> doE irq_handler_intent <- throw_opt undefined (get_irq_handler_intent (IrqHandlerIntent IrqHandlerSetEndpointIntent));
liftME InvokeIrqHandler (decode_irq_handler_invocation (IrqHandlerCap irq) ref cs irq_handler_intent)
odE \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (IrqHandlerCap irq)) \<mapsto>irq ?obj58 iv \<and>* (?obj57 iv, 0) \<mapsto>c ?cap'56 iv) \<and>* (the (cdl_cap_irq (IrqHandlerCap irq)) \<mapsto>irq ?obj55 iv \<and>* (?obj54 iv, 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'53 iv) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> iv = InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq (IrqHandlerCap irq))) endpoint_cap (cap_object cnode_cap, irq_handler_slot))\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?P'96 (fst fail) (snd fail) xa and K (fst fail = irq_cap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 3. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 5. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (7 subgoals):
 1. \<And>c ref cs x. c = IrqHandlerCap irq \<Longrightarrow> \<lbrace>?P'107 c ref cs x\<rbrace> decode_irq_handler_invocation (IrqHandlerCap irq) ref cs x \<lbrace>(\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (IrqHandlerCap irq)) \<mapsto>irq ?obj58 iv \<and>* (?obj57 iv, 0) \<mapsto>c ?cap'56 iv) \<and>* (the (cdl_cap_irq (IrqHandlerCap irq)) \<mapsto>irq ?obj55 iv \<and>* (?obj54 iv, 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'53 iv) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> iv = InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq (IrqHandlerCap irq))) endpoint_cap (cap_object cnode_cap, irq_handler_slot))) \<circ> InvokeIrqHandler\<rbrace>, -
 2. \<And>c ref cs. c = IrqHandlerCap irq \<Longrightarrow> \<lbrace>?P'96 (IrqHandlerCap irq) ref cs\<rbrace> throw_opt undefined (get_irq_handler_intent (IrqHandlerIntent IrqHandlerSetEndpointIntent)) \<lbrace>\<lambda>x s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> ?P'107 c ref cs x s\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?P'96 (fst fail) (snd fail) xa and K (fst fail = irq_cap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 4. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 6. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 7. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (7 subgoals):
 1. \<And>c ref cs x. \<lbrakk>c = IrqHandlerCap irq; x = IrqHandlerSetEndpointIntent\<rbrakk> \<Longrightarrow> \<lbrace>?P'110 (IrqHandlerCap irq) ref cs IrqHandlerSetEndpointIntent\<rbrace> decode_irq_handler_invocation (IrqHandlerCap irq) ref cs IrqHandlerSetEndpointIntent \<lbrace>\<lambda>a b. cdl_current_thread b = Some root_tcb_id \<and> cdl_current_domain b = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>b. ((the (cdl_cap_irq (IrqHandlerCap irq)) \<mapsto>irq ?obj58 (InvokeIrqHandler a) \<and>* (?obj57 (InvokeIrqHandler a), 0) \<mapsto>c ?cap'56 (InvokeIrqHandler a)) \<and>* (the (cdl_cap_irq (IrqHandlerCap irq)) \<mapsto>irq ?obj55 (InvokeIrqHandler a) \<and>* (?obj54 (InvokeIrqHandler a), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R)) a))) b \<and> \<not> ep_related_cap (?cap'53 (InvokeIrqHandler a)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) b \<and> a = SetIrqHandler (the (cdl_cap_irq (IrqHandlerCap irq))) endpoint_cap (cap_object cnode_cap, irq_handler_slot)\<rbrace>, -
 2. \<And>c ref cs. c = IrqHandlerCap irq \<Longrightarrow> \<lbrace>?P'96 (IrqHandlerCap irq) ref cs\<rbrace> throw_opt undefined (get_irq_handler_intent (IrqHandlerIntent IrqHandlerSetEndpointIntent)) \<lbrace>\<lambda>x s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> (?P'110 c ref cs x and K (x = IrqHandlerSetEndpointIntent)) s\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?P'96 (fst fail) (snd fail) xa and K (fst fail = irq_cap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 4. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 6. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 7. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. c = IrqHandlerCap irq \<Longrightarrow> \<lbrace>?P'96 (IrqHandlerCap irq) ref cs\<rbrace> throw_opt undefined (get_irq_handler_intent (IrqHandlerIntent IrqHandlerSetEndpointIntent)) \<lbrace>\<lambda>x s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> ((\<lambda>a. (cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj124 c x \<and>* (?obj123 c x, 0) \<mapsto>c ?cap'122 c x) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj121 c x \<and>* (?obj120 c x, 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'119 c x) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) a \<and> SetIrqHandler (the $ cdl_cap_irq c) endpoint_cap endpoint_ptr = SetIrqHandler (the (cdl_cap_irq c)) endpoint_cap (cap_object cnode_cap, irq_handler_slot)) \<and> cs = [(endpoint_cap, endpoint_ptr)] @ [] \<and> is_ntfn_cap endpoint_cap) and K (x = IrqHandlerSetEndpointIntent)) s\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?P'96 (fst fail) (snd fail) xa and K (fst fail = irq_cap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 3. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 5. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (6 subgoals):
 1. \<And>c ref cs. c = IrqHandlerCap irq \<Longrightarrow> \<lbrace>?P'96 (IrqHandlerCap irq) ref cs\<rbrace> returnOk IrqHandlerSetEndpointIntent \<lbrace>\<lambda>x s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (IrqHandlerCap irq)) \<mapsto>irq ?obj124 (IrqHandlerCap irq) x \<and>* (?obj123 (IrqHandlerCap irq) x, 0) \<mapsto>c ?cap'122 (IrqHandlerCap irq) x) \<and>* (the (cdl_cap_irq (IrqHandlerCap irq)) \<mapsto>irq ?obj121 (IrqHandlerCap irq) x \<and>* (?obj120 (IrqHandlerCap irq) x, 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'119 (IrqHandlerCap irq) x) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> cs = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> x = IrqHandlerSetEndpointIntent\<rbrace>, \<lbrace>\<lambda>fail s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. ?P'96 (fst fail) (snd fail) xa and K (fst fail = irq_cap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 3. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 5. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 6. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (5 subgoals):
 1. \<And>fail. \<lbrace>?Pd1.6 (fst fail) (snd fail)\<rbrace> lookup_extra_caps root_tcb_id [endpoint_cptr] \<lbrace>\<lambda>xa. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst fail)) \<mapsto>irq ?obj139 (fst fail) \<and>* (?obj138 (fst fail), 0) \<mapsto>c ?cap'137 (fst fail)) \<and>* (the (cdl_cap_irq (fst fail)) \<mapsto>irq ?obj136 (fst fail) \<and>* (?obj135 (fst fail), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst fail \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'134 (fst fail)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) a \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> xa = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) and K (fst fail = irq_cap)\<rbrace>, \<lbrace>\<lambda>fail s. False\<rbrace>
 2. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ?Pd1.6 (fst fail) (snd fail) s \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 4. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 5. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (4 subgoals):
 1. \<lbrace>?Pd2.6\<rbrace> lookup_cap_and_slot root_tcb_id irq_handler_cap \<lbrace>\<lambda>fail s. ((\<forall>c. reset_cap_asid c = reset_cap_asid endpoint_cap \<longrightarrow> ((\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst fail)) \<mapsto>irq ?obj160 (fst fail) (snd fail) \<and>* (?obj159 (fst fail) (snd fail), 0) \<mapsto>c ?cap'158 (fst fail) (snd fail)) \<and>* (the (cdl_cap_irq (fst fail)) \<mapsto>irq ?obj157 (fst fail) (snd fail) \<and>* (?obj156 (fst fail) (snd fail), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst fail \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst fail) (snd fail)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) a \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(c, cap_object (?cap154 (fst fail) (snd fail)), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) and K (fst fail = irq_cap)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst fail) (snd fail) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst fail) (snd fail) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst fail) (snd fail)) s) \<and> \<not> ep_related_cap (fst fail)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.6\<rbrace>
 3. \<And>s. ?Pd2.6 s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap152 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap154 (fst fail) (snd fail)
\<lambda>fail. ?cap152 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap153 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (3 subgoals):
 1. \<lbrace>?P6\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> ((\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (c, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) a \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(ca, cap_object (?cap154 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) and K (fst (c, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrace>
 2. \<And>s. (\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> ((\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (c, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) a \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(ca, cap_object (?cap154 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) and K (fst (c, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P6 (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (2 subgoals):
 1. \<And>s. (\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> ((\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> ((\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (c, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) a \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(ca, cap_object (?cap154 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) and K (fst (c, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap)) s) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (c, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (c, cap_object ?cap161, offset irq_handler_cap root_size))) s) \<and> \<not> ep_related_cap (fst (c, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (4 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s \<Longrightarrow> reset_cap_asid (?c310 s) = reset_cap_asid irq_cap
 2. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s; (\<forall>c. reset_cap_asid c = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (?c310 s)) \<mapsto>irq ?obj160 (?c310 s) (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 (?c310 s) (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 (?c310 s) (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq (?c310 s)) \<mapsto>irq ?obj157 (?c310 s) (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 (?c310 s) (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c ?c310 s \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (?c310 s) (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> c = endpoint_cap \<and> (cap_object (?cap154 (?c310 s) (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> ?c310 s = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (?c310 s) (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 (?c310 s) (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (?c310 s) (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap (?c310 s)\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s; (\<forall>c. reset_cap_asid c = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj160 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj157 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c irq_cap \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> c = endpoint_cap \<and> (cap_object (?cap154 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> irq_cap = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap irq_cap\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) s; \<not> ep_related_cap irq_cap\<rbrakk> \<Longrightarrow> reset_cap_asid (?c322 s) = reset_cap_asid endpoint_cap
 2. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) s; \<not> ep_related_cap irq_cap; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj160 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj157 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c irq_cap \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ?c322 s = endpoint_cap \<and> (cap_object (?cap154 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> irq_cap = irq_cap\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) s; \<not> ep_related_cap irq_cap; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj160 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj157 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c irq_cap \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> endpoint_cap = endpoint_cap \<and> (cap_object (?cap154 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> irq_cap = irq_cap\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (4 subgoals):
 1. \<And>s. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s \<Longrightarrow> reset_cap_asid (?c336 s) = reset_cap_asid irq_cap
 2. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s; (\<forall>c. reset_cap_asid c = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (?c336 s)) \<mapsto>irq ?obj160 (?c336 s) (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 (?c336 s) (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 (?c336 s) (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq (?c336 s)) \<mapsto>irq ?obj157 (?c336 s) (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 (?c336 s) (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c ?c336 s \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (?c336 s) (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> c = endpoint_cap \<and> (cap_object (?cap154 (?c336 s) (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> ?c336 s = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (?c336 s) (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 (?c336 s) (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (?c336 s) (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap (?c336 s)\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s; (\<forall>c. reset_cap_asid c = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj160 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj157 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c irq_cap \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> c = endpoint_cap \<and> (cap_object (?cap154 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> irq_cap = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap irq_cap\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) s; \<not> ep_related_cap irq_cap\<rbrakk> \<Longrightarrow> reset_cap_asid (?c348 s) = reset_cap_asid endpoint_cap
 2. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) s; \<not> ep_related_cap irq_cap; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj160 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj157 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c irq_cap \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ?c348 s = endpoint_cap \<and> (cap_object (?cap154 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> irq_cap = irq_cap\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound
 3. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 4. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) s; \<not> ep_related_cap irq_cap; cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj160 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq irq_cap) \<mapsto>irq ?obj157 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c irq_cap \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> endpoint_cap = endpoint_cap \<and> (cap_object (?cap154 irq_cap (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> irq_cap = irq_cap\<rbrakk> \<Longrightarrow> cdl_current_domain s = minBound
 2. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 3. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<forall>c. reset_cap_asid c = reset_cap_asid irq_cap \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid endpoint_cap \<longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq c) \<mapsto>irq ?obj160 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq c) \<mapsto>irq ?obj157 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 c (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c c \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 c (cap_object ?cap161, offset irq_handler_cap root_size)) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) s \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> ca = endpoint_cap \<and> (cap_object (?cap154 c (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> is_ntfn_cap endpoint_cap \<and> c = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 c (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 c (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 c (cap_object ?cap161, offset irq_handler_cap root_size)) s \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) s
 2. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ?R161) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (1 subgoal):
 1. \<And>s. ((\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s)) and (\<lambda>y. \<not> ep_related_cap cap' \<and> \<not> ep_related_cap irq_cap \<and> cap_type endpoint_cap \<noteq> Some UntypedType \<and> \<not> is_memory_cap endpoint_cap \<and> one_lvl_lookup cnode_cap word_bits root_size \<and> guard_equal cnode_cap endpoint_cptr word_bits \<and> is_ntfn_cap endpoint_cap \<and> guard_equal cnode_cap irq_handler_cap word_bits \<and> is_cnode_cap cnode_cap \<and> is_irqhandler_cap irq_cap)) s \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (IrqHandlerIntent IrqHandlerSetEndpointIntent), cdl_intent_error = False, cdl_intent_cap = irq_handler_cap, cdl_intent_extras = [endpoint_cptr], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid irq_cap \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid endpoint_cap \<or> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<and> (cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj160 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj159 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c ?cap'158 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and>* (the (cdl_cap_irq (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<mapsto>irq ?obj157 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (?obj156 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c fst (x, cap_object ?cap161, offset irq_handler_cap root_size) \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cap_type endpoint_cap \<noteq> Some UntypedType))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> [(xa, cap_object (?cap154 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))), offset endpoint_cptr root_size)] = [(endpoint_cap, endpoint_ptr)] \<and> is_ntfn_cap endpoint_cap \<and> IrqHandlerSetEndpointIntent = IrqHandlerSetEndpointIntent) \<and> K (fst (x, cap_object ?cap161, offset irq_handler_cap root_size) = irq_cap) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* \<box> (root_size, word_bits) : ?cap152 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size)) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 (fst (x, cap_object ?cap161, offset irq_handler_cap root_size)) (snd (x, cap_object ?cap161, offset irq_handler_cap root_size))) (kernel_state s) \<and> \<not> ep_related_cap (fst (x, cap_object ?cap161, offset irq_handler_cap root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x = reset_cap_asid irq_cap \<longrightarrow> (\<forall>xa. reset_cap_asid xa = endpoint_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq x) \<mapsto>irq ?obj160 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 x (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq x) \<mapsto>irq ?obj157 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 x (cap_object ?cap161, offset irq_handler_cap root_size))))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> xa = endpoint_cap \<and> (cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> x = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> \<forall>x. reset_cap_asid x = reset_cap_asid irq_cap \<longrightarrow> (\<forall>xa. reset_cap_asid xa = endpoint_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq x) \<mapsto>irq ?obj160 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 x (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq x) \<mapsto>irq ?obj157 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 x (cap_object ?cap161, offset irq_handler_cap root_size))))) (kernel_state s) \<and> endpoint_ptr = (cap_object cnode_cap, irq_handler_slot) \<and> xa = endpoint_cap \<and> (cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)), offset endpoint_cptr root_size) = endpoint_ptr \<and> x = irq_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s) \<and> \<not> ep_related_cap x
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 3. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (3 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> (\<forall>xa. reset_cap_asid xa = endpoint_cap \<longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq x) \<mapsto>irq ?obj160 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 x (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq x) \<mapsto>irq ?obj157 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 x (cap_object ?cap161, offset irq_handler_cap root_size))))) (kernel_state s) \<and> xa = endpoint_cap \<and> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap \<and> x = IrqHandlerCap irq) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s) \<and> \<not> ep_related_cap x
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 3. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (9 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s)
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq x) \<mapsto>irq ?obj160 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 x (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq x) \<mapsto>irq ?obj157 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 x (cap_object ?cap161, offset irq_handler_cap root_size))))) (kernel_state s)
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> xa = endpoint_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 9. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (8 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<longrightarrow>* (\<lambda>a. ((the (cdl_cap_irq x) \<mapsto>irq ?obj160 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 x (cap_object ?cap161, offset irq_handler_cap root_size)) \<and>* (the (cdl_cap_irq x) \<mapsto>irq ?obj157 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) a))) a \<and> \<not> ep_related_cap (?cap'155 x (cap_object ?cap161, offset irq_handler_cap root_size))))) (kernel_state s)
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> xa = endpoint_cap
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 7. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (8 subgoals):
 1. \<And>s x xa sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) sb\<rbrakk> \<Longrightarrow> (the (cdl_cap_irq x) \<mapsto>irq ?obj160 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (the (cdl_cap_irq x) \<mapsto>irq ?obj157 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) a))) sb \<and> \<not> ep_related_cap (?cap'155 x (cap_object ?cap161, offset irq_handler_cap root_size))
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> xa = endpoint_cap
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 7. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (9 subgoals):
 1. \<And>s x xa sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) sb\<rbrakk> \<Longrightarrow> (the (cdl_cap_irq x) \<mapsto>irq ?obj160 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj159 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c ?cap'158 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (the (cdl_cap_irq x) \<mapsto>irq ?obj157 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* (?obj156 x (cap_object ?cap161, offset irq_handler_cap root_size), 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) a))) sb
 2. \<And>s x xa sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) sb\<rbrakk> \<Longrightarrow> \<not> ep_related_cap (?cap'155 x (cap_object ?cap161, offset irq_handler_cap root_size))
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> xa = endpoint_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 9. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?obj160 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj139 (fst fail)
\<lambda>fail. ?obj159 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj138 (fst fail)
\<lambda>fail. ?cap'158 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'137 (fst fail)
\<lambda>fail. ?obj157 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj136 (fst fail)
\<lambda>fail. ?obj156 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?obj135 (fst fail)
\<lambda>fail. ?cap'155 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap'134 (fst fail)
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
?obj139 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj124 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj138 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj123 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'137 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'122 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj136 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj121 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj135 (IrqHandlerCap irq) \<equiv>\<^sup>? ?obj120 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?cap'134 (IrqHandlerCap irq) \<equiv>\<^sup>? ?cap'119 (IrqHandlerCap irq) IrqHandlerSetEndpointIntent
?obj124 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj58 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj123 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj57 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'122 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'56 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj121 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj55 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj120 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?cap'119 (IrqHandlerCap irq) (ds_id IrqHandlerSetEndpointIntent) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the $ cdl_cap_irq (IrqHandlerCap irq)) endpoint_cap endpoint_ptr))
?obj58 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj57 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?cap'56 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?cap'53 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr))
?obj55 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) \<equiv>\<^sup>? ?obj54 (InvokeIrqHandler (SetIrqHandler (the (cdl_cap_irq irq_cap)) endpoint_cap endpoint_ptr)) proof (prove)
goal (9 subgoals):
 1. \<And>s x xa sa sb sc. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) sc\<rbrakk> \<Longrightarrow> (the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) a))) sc
 2. \<And>s x xa sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) sb\<rbrakk> \<Longrightarrow> \<not> ep_related_cap cap'
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> xa = endpoint_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 9. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (9 subgoals):
 1. \<And>s x xa sa sb sc. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) sc; the (cdl_cap_irq x) = irq\<rbrakk> \<Longrightarrow> (the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) a))) sc
 2. \<And>s x xa sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) sb\<rbrakk> \<Longrightarrow> \<not> ep_related_cap cap'
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> xa = endpoint_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 9. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (9 subgoals):
 1. \<And>s x sc. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap (the (cdl_cap_irq x))); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap (the (cdl_cap_irq x)); ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* the (cdl_cap_irq x) \<mapsto>irq obj \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap (the (cdl_cap_irq x)) \<and>* R) sc; irq = the (cdl_cap_irq x)\<rbrakk> \<Longrightarrow> (the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<longrightarrow>* (\<lambda>a. ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) a))) sc
 2. \<And>s x xa sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) sb\<rbrakk> \<Longrightarrow> \<not> ep_related_cap cap'
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> xa = endpoint_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 9. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (9 subgoals):
 1. \<And>s x sc sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap (the (cdl_cap_irq x))); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap (the (cdl_cap_irq x)); irq = the (cdl_cap_irq x); ((the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap (the (cdl_cap_irq x)) \<and>* R) sb\<rbrakk> \<Longrightarrow> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sb \<and> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) sb
 2. \<And>s x xa sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap; ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) sb\<rbrakk> \<Longrightarrow> \<not> ep_related_cap cap'
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> xa = endpoint_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; reset_cap_asid xa = endpoint_cap\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 9. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (9 subgoals):
 1. \<And>s x sc sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap (the (cdl_cap_irq x))); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap (the (cdl_cap_irq x)); irq = the (cdl_cap_irq x); ((the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap (the (cdl_cap_irq x)) \<and>* R) sb\<rbrakk> \<Longrightarrow> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sb
 2. \<And>s x sc sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap (the (cdl_cap_irq x))); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap (the (cdl_cap_irq x)); irq = the (cdl_cap_irq x); ((the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap (the (cdl_cap_irq x)) \<and>* R) sb\<rbrakk> \<Longrightarrow> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) sb
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> xa = reset_cap_asid xa
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 7. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 9. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (8 subgoals):
 1. \<And>s x sc sa sb. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap (the (cdl_cap_irq x))); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap (the (cdl_cap_irq x)); irq = the (cdl_cap_irq x); ((the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap) \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap (the (cdl_cap_irq x)) \<and>* R) sb\<rbrakk> \<Longrightarrow> ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* the (cdl_cap_irq x) \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x \<and>* R)) sb
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> xa = reset_cap_asid xa
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 7. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (8 subgoals):
 1. \<And>s x sc sa sb sd se sf sg sh si sj sk sl sm. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap (the (cdl_cap_irq x))); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap (the (cdl_cap_irq x)); irq = the (cdl_cap_irq x); ((cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap (the (cdl_cap_irq x))) sm\<rbrakk> \<Longrightarrow> ((cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c x) sm
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> xa = reset_cap_asid xa
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 7. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (8 subgoals):
 1. \<And>s x sc sa sb sd se sf sg sh si sj sk sl sm. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap (the (cdl_cap_irq x))); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap (the (cdl_cap_irq x)); irq = the (cdl_cap_irq x)\<rbrakk> \<Longrightarrow> reset_cap_asid x = reset_cap_asid (IrqHandlerCap (the (cdl_cap_irq x)))
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> xa = reset_cap_asid xa
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 6. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 7. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 8. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (7 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> xa = reset_cap_asid xa
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 4. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 5. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 6. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 7. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (6 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 3. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 4. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 5. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 6. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (6 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cap_object (?cap154 x (cap_object ?cap161, offset irq_handler_cap root_size)) = cap_object cnode_cap
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 3. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap153 x (cap_object ?cap161, offset irq_handler_cap root_size) \<and>* \<box> (root_size, word_bits) : ?cap152 x (cap_object ?cap161, offset irq_handler_cap root_size) endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 4. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 5. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 6. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
flex-flex pairs:
\<lambda>fail. ?cap154 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail)
\<lambda>fail. ?cap153 (fst fail) (snd fail) \<equiv>\<^sup>? \<lambda>fail. ?cap152 (fst fail) (snd fail) proof (prove)
goal (5 subgoals):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq
 2. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 3. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 4. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 5. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap endpoint_cptr \<mapsto>u endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 2. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 3. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 4. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq proof (prove)
goal (5 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* ?R151 x (cap_object ?cap161, offset irq_handler_cap root_size)) (kernel_state s)
 2. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 3. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap161 \<and>* \<box> (root_size, word_bits) : ?cap161 irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 4. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
 5. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq proof (prove)
goal (4 subgoals):
 1. \<And>s x. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; ep_related_cap x\<rbrakk> \<Longrightarrow> False
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 3. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
 4. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) (kernel_state s)
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) sa\<rbrakk> \<Longrightarrow> (\<box> (root_size, word_bits) : cnode_cap irq_handler_cap \<mapsto>u irq_cap \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap irq_handler_cap \<mapsto>u irq_cap \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) sa
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>\<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) sa\<rbrakk> \<Longrightarrow> (cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<longrightarrow>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>a. True))) sa
 2. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
 3. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cnode_id \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* endpoint_ptr \<mapsto>c endpoint_cap \<and>* irq_ptr \<mapsto>c irq_cap \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap irq_cap; \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; is_irqhandler_cap irq_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c endpoint_cap \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap endpoint_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap endpoint_cap; guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb t \<and>* (\<lambda>s. True)) (kernel_state s)
 2. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq proof (prove)
goal (1 subgoal):
 1. \<And>s x xa. \<lbrakk>cdl.lift (root_tcb_id \<mapsto>f Tcb t \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* irq \<mapsto>irq obj \<and>* (obj, 0) \<mapsto>c cap' \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* (cap_object cnode_cap, irq_handler_slot) \<mapsto>c reset_cap_asid xa \<and>* (cap_object cnode_cap, offset irq_handler_cap root_size) \<mapsto>c IrqHandlerCap irq \<and>* R) (kernel_state s); \<not> ep_related_cap cap'; \<not> ep_related_cap (IrqHandlerCap irq); \<not> is_memory_cap (reset_cap_asid xa); one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap endpoint_cptr word_bits; is_ntfn_cap (reset_cap_asid xa); guard_equal cnode_cap irq_handler_cap word_bits; is_cnode_cap cnode_cap; cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; reset_cap_asid x = IrqHandlerCap irq; endpoint_cap = reset_cap_asid xa\<rbrakk> \<Longrightarrow> x = IrqHandlerCap irq proof (prove)
goal:
No subgoals!