theory TCB_DP

lemma seL4_TCB_WriteRegisters_wp:
  "\<lbrakk> is_cnode_cap cnode_cap;
    \<comment> \<open>Caps point to the right objects.\<close>
     one_lvl_lookup cnode_cap word_bits root_size;
     guard_equal cnode_cap tcb_ref word_bits;
     is_tcb root_tcb;
     is_tcb_cap tcb_cap;
     tcb_id = cap_object tcb_cap \<rbrakk> \<Longrightarrow>
   \<lbrace> \<guillemotleft> root_tcb_id \<mapsto>f root_tcb
     \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
     \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap
     \<and>* tcb_id \<mapsto>f tcb
     \<and>* (tcb_id, tcb_pending_op_slot) \<mapsto>c NullCap
     \<and>* (tcb_id, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap
     \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size)
     \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap
     \<and>* R \<guillemotright> \<rbrace>
  seL4_TCB_WriteRegisters tcb_ref False 0 2 regs
  \<lbrace>\<lambda>_.  \<guillemotleft> root_tcb_id \<mapsto>f root_tcb
    \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
    \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap
    \<and>* tcb_id \<mapsto>f tcb
    \<and>* (tcb_id, tcb_pending_op_slot) \<mapsto>c NullCap
    \<and>* (tcb_id, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap
    \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size)
    \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap
    \<and>* R \<guillemotright> \<rbrace>" apply (simp add:seL4_TCB_WriteRegisters_def
    sep_state_projection2_def
    is_tcb_def split:cdl_object.splits) apply (rename_tac cdl_tcb) apply (wp do_kernel_op_pull_back) apply (rule hoare_post_imp[OF _ call_kernel_with_intent_allow_error_helper
     [where check = False,simplified]]) apply (rename_tac rv s) apply clarsimp apply (case_tac rv, (clarsimp,assumption)+)[1] apply fastforce apply (rule hoare_strengthen_post[OF set_cap_wp]) apply (sep_select 3,sep_cancel) apply (wp+)[4] apply (rule_tac P= "
           iv = (InvokeTcb $ WriteRegisters (cap_object tcb_cap) False [0] 0)" in hoare_gen_asmEx) apply (clarsimp simp:invoke_tcb_def) apply (wp restart_cdl_current_thread[where cap = RestartCap]
          restart_cdl_current_domain[where cap = RestartCap]) apply (wp set_cap_wp hoare_vcg_conj_lift) apply (rule_tac R1="root_tcb_id \<mapsto>f Tcb cdl_tcb  \<and>* Q" for Q in
          hoare_post_imp[OF _ set_cap_wp]) apply sep_solve apply wp apply (rule_tac P = "c = TcbCap (cap_object tcb_cap)"
          in hoare_gen_asmEx) apply (simp add: decode_invocation_def
          throw_opt_def get_tcb_intent_def decode_tcb_invocation_def) apply wp apply (clarsimp simp:conj_comms lookup_extra_caps_def
         mapME_def sequenceE_def) apply (rule returnOk_wp) apply (rule lookup_cap_and_slot_rvu
        [where r=root_size and cap=cnode_cap and cap'=tcb_cap]) apply clarsimp apply (wp hoare_vcg_ball_lift hoare_vcg_conj_lift hoare_vcg_imp_lift hoare_vcg_all_lift) apply (wp update_thread_intent_update)+ apply clarify apply (drule_tac x = tcb_cap in spec) apply clarsimp apply (erule use_sep_true_for_sep_map_c) apply sep_solve apply (intro conjI impI allI) apply (clarsimp simp:is_tcb_def reset_cap_asid_tcb
           split:cdl_object.splits cdl_cap.splits)+ apply (simp add: ep_related_cap_def cap_type_def cap_object_def
          split:cdl_cap.splits) apply ((rule conjI|sep_solve)+)[1] apply (clarsimp simp: user_pointer_at_def Let_unfold sep_conj_assoc is_tcb_def) apply sep_cancel+ apply sep_solve done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; is_tcb root_tcb; is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap\<rbrakk> \<Longrightarrow> \<lbrace>Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* tcb_id \<mapsto>f tcb \<and>* (tcb_id, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (tcb_id, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> seL4_TCB_WriteRegisters tcb_ref False 0 2 regs \<lbrace>\<lambda>_. Separation_SD.lift (root_tcb_id \<mapsto>f root_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* tcb_id \<mapsto>f tcb \<and>* (tcb_id, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (tcb_id, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x3. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb x3\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> False) \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb x3 \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> False) \<lbrace>\<lambda>_ s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P44 cdl_tcb\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> False \<lbrace>\<lambda>_. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> ?P44 cdl_tcb (kernel_state s) proof (prove)
goal (15 subgoals):
 1. \<And>cdl_tcb rv s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (\<not> rv \<longrightarrow> ?Q46 cdl_tcb s) \<and> (rv \<longrightarrow> ?Perror46 cdl_tcb s)\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op46 cdl_tcb) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr46 cdl_tcb \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_extra46 cdl_tcb
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?R46 cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. ?Q46 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra46 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R46 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror46 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. ?Perror46 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb46 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra46 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror46 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Perror46 cdl_tcb\<rbrace>
 8. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV46 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb46 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op46 cdl_tcb) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.46 cdl_tcb s\<rbrace>
 9. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV46 cdl_tcb iv\<rbrace>
 10. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (?intent_op46 cdl_tcb) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?Perror46 cdl_tcb s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>cdl_tcb rv s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (\<not> rv \<longrightarrow> ?Q46 cdl_tcb s) \<and> (rv \<longrightarrow> ?Perror46 cdl_tcb s)\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op46 cdl_tcb) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr46 cdl_tcb \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_extra46 cdl_tcb
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?R46 cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. ?Q46 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra46 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R46 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror46 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. ?Perror46 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb46 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra46 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror46 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Perror46 cdl_tcb\<rbrace>
 8. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV46 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb46 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op46 cdl_tcb) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.46 cdl_tcb s\<rbrace>
 9. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV46 cdl_tcb iv\<rbrace>
 10. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (?intent_op46 cdl_tcb) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?Perror46 cdl_tcb s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>cdl_tcb rv s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; \<not> rv \<longrightarrow> ?Q46 cdl_tcb s; rv \<longrightarrow> ?Perror46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op46 cdl_tcb) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr46 cdl_tcb \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_extra46 cdl_tcb
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?R46 cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. ?Q46 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra46 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R46 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror46 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. ?Perror46 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb46 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra46 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Perror46 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Perror46 cdl_tcb\<rbrace>
 8. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV46 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb46 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op46 cdl_tcb) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.46 cdl_tcb s\<rbrace>
 9. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV46 cdl_tcb iv\<rbrace>
 10. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (?intent_op46 cdl_tcb) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. ?Perror46 cdl_tcb s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op46 cdl_tcb) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr46 cdl_tcb \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> = ?intent_extra46 cdl_tcb
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?R46 cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra46 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R46 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb46 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra46 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 7. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV46 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb46 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op46 cdl_tcb) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.46 cdl_tcb s\<rbrace>
 8. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV46 cdl_tcb iv\<rbrace>
 9. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (?intent_op46 cdl_tcb) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 10. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id (?intent_extra46 cdl_tcb) \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?R46 cdl_tcb\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra46 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. ?R46 cdl_tcb\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb46 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra46 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 6. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV46 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb46 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.46 cdl_tcb s\<rbrace>
 7. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV46 cdl_tcb iv\<rbrace>
 8. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 10. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cdl_tcb rv s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* ?R81 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra46 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R81 cdl_tcb)\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb46 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra46 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 6. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV46 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb46 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.46 cdl_tcb s\<rbrace>
 7. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV46 cdl_tcb iv\<rbrace>
 8. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 10. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ra46 cdl_tcb\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>r. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R))\<rbrace>
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Rb46 cdl_tcb\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. ?Ra46 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>r. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)\<rbrace>
 5. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV46 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> ?Rb46 cdl_tcb s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.46 cdl_tcb s\<rbrace>
 6. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV46 cdl_tcb iv\<rbrace>
 7. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 8. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 9. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 10. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?PIV46 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.46 cdl_tcb s\<rbrace>
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?PIV46 cdl_tcb iv\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; iv = (InvokeTcb $ WriteRegisters (cap_object tcb_cap) False [0] 0)\<rbrakk> \<Longrightarrow> \<lbrace>?P'114 cdl_tcb iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> no_pending s \<and> ?Pd2.46 cdl_tcb s\<rbrace>
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'114 cdl_tcb iv and K (iv = (InvokeTcb $ WriteRegisters (cap_object tcb_cap) False [0] 0))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'114 cdl_tcb (InvokeTcb (WriteRegisters (cap_object tcb_cap) False [0] 0))\<rbrace> corrupt_tcb_intent (cap_object tcb_cap) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s\<rbrace>
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. ?P'114 cdl_tcb iv and K (iv = (InvokeTcb $ WriteRegisters (cap_object tcb_cap) False [0] 0))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Ps46 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>r. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) a \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) a) and K (iv = (InvokeTcb $ WriteRegisters (cap_object tcb_cap) False [0] 0))\<rbrace>
 2. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>?Ps46 cdl_tcb\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'136 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R))\<rbrace>
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'131 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (iv = (InvokeTcb $ WriteRegisters (cap_object tcb_cap) False [0] 0))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> ?P'136 cdl_tcb iv s) \<and> ?P'131 cdl_tcb iv s\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (8 subgoals):
 1. \<And>cdl_tcb iv rv s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ?Q143 cdl_tcb iv) s\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s
 2. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'131 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (iv = (InvokeTcb $ WriteRegisters (cap_object tcb_cap) False [0] 0))\<rbrace>
 3. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ?Q143 cdl_tcb iv) s) \<and> ?P'131 cdl_tcb iv s\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 8. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (7 subgoals):
 1. \<And>cdl_tcb iv. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'131 cdl_tcb iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (iv = (InvokeTcb $ WriteRegisters (cap_object tcb_cap) False [0] 0))\<rbrace>
 2. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> ?P'131 cdl_tcb iv s\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 7. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd46 cdl_tcb cs c ref\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> K (iv = (InvokeTcb $ WriteRegisters (cap_object tcb_cap) False [0] 0)) s\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?Pd46 cdl_tcb xa (fst r) (snd r)\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; c = TcbCap (cap_object tcb_cap)\<rbrakk> \<Longrightarrow> \<lbrace>?P'178 cdl_tcb c ref cs\<rbrace> decode_invocation c ref cs (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)) \<lbrace>\<lambda>iv s. (cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> K (iv = (InvokeTcb $ WriteRegisters (cap_object tcb_cap) False [0] 0)) s\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?P'178 cdl_tcb (fst r) (snd r) xa and K (fst r = TcbCap (cap_object tcb_cap))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (6 subgoals):
 1. \<And>cdl_tcb c ref cs. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; c = TcbCap (cap_object tcb_cap)\<rbrakk> \<Longrightarrow> \<lbrace>?P'178 cdl_tcb (TcbCap (cap_object tcb_cap)) ref cs\<rbrace> liftME InvokeTcb (returnOk (WriteRegisters (cap_object tcb_cap) False [0] 0) \<sqinter> throw) \<lbrace>\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s \<and> iv = InvokeTcb (WriteRegisters (cap_object tcb_cap) False [0] 0)\<rbrace>, \<lbrace>\<lambda>r s. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ?P'178 cdl_tcb (fst r) (snd r) xa and K (fst r = TcbCap (cap_object tcb_cap))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 6. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb r. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb (fst r) (snd r)\<rbrace> lookup_extra_caps root_tcb_id [] \<lbrace>\<lambda>xa. ((\<lambda>iv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s \<and> iv = InvokeTcb (WriteRegisters (cap_object tcb_cap) False [0] 0)) \<circ> InvokeTcb) (WriteRegisters (cap_object tcb_cap) False [0] 0) and (\<lambda>a. cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) a \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> True) and K (fst r = TcbCap (cap_object tcb_cap))\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb a aa b. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.46 cdl_tcb a (aa, b)\<rbrace> returnOk [] \<lbrace>\<lambda>xa s. cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> a = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s\<rbrace>, \<lbrace>\<lambda>r s. False\<rbrace>
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. ?Pd1.46 cdl_tcb (fst r) (snd r) s \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 4. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (4 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.46 cdl_tcb\<rbrace> lookup_cap_and_slot root_tcb_id tcb_ref \<lbrace>\<lambda>r s. (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> fst r = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> \<not> ep_related_cap (fst r)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.46 cdl_tcb\<rbrace>
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ?Pd2.46 cdl_tcb s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 4. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) s\<rbrace>
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P46 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> c = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s \<and> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) s\<rbrace>
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> ?P46 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (5 subgoals):
 1. \<And>cdl_tcb c. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P238 cdl_tcb c\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True))\<rbrace>
 2. \<And>cdl_tcb c. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'238 cdl_tcb c\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s \<and> \<not> ep_related_cap c\<rbrace>
 3. \<And>cdl_tcb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'228 cdl_tcb\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb)\<rbrace>
 4. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 5. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> x = TcbCap (cap_object tcb_cap) \<and> ?P238 cdl_tcb x (kernel_state s) \<and> ?P'238 cdl_tcb x (kernel_state s)) \<and> ?P'228 cdl_tcb (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; (\<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> x = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) (kernel_state s) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; \<forall>c. reset_cap_asid c = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> fst (c, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> \<not> ep_related_cap (fst (c, cap_object cnode_cap, offset tcb_ref root_size)); cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) s\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> x = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) (kernel_state s) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) s; reset_cap_asid tcb_cap = reset_cap_asid tcb_cap \<longrightarrow> (cdl_current_domain s = minBound \<and> cdl_current_thread s = Some root_tcb_id \<and> fst (tcb_cap, cap_object cnode_cap, offset tcb_ref root_size) = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s) \<and> \<not> ep_related_cap (fst (tcb_cap, cap_object cnode_cap, offset tcb_ref root_size))\<rbrakk> \<Longrightarrow> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> x = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) (kernel_state s) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) s; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; tcb_cap = TcbCap (cap_object tcb_cap); cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s; \<not> ep_related_cap tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> x = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) (kernel_state s) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) s; cdl_current_domain s = minBound; cdl_current_thread s = Some root_tcb_id; tcb_cap = TcbCap (cap_object tcb_cap); cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) s; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) s; \<not> ep_related_cap tcb_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) s
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> x = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) (kernel_state s) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb (?tcb46 cdl_tcb) \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> x = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) (kernel_state s) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (4 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (TcbIntent (TcbWriteRegistersIntent False 0 2 regs)), cdl_intent_error = False, cdl_intent_cap = tcb_ref, cdl_intent_extras = [], cdl_intent_recv_slot = None\<rparr>
 2. \<And>cdl_tcb s x. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> reset_cap_asid x \<noteq> reset_cap_asid tcb_cap \<or> cdl_current_domain (kernel_state s) = minBound \<and> cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> x = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) (kernel_state s) \<and> \<not> ep_related_cap x
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)
 4. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> tcb_cap = TcbCap (cap_object tcb_cap) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R)) (kernel_state s) \<and> \<not> ep_related_cap tcb_cap
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (3 subgoals):
 1. \<And>cdl_tcb s x71 x72 x73 x74. \<lbrakk>one_lvl_lookup (CNodeCap x71 x72 x73 x74) word_bits root_size; guard_equal (CNodeCap x71 x72 x73 x74) tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c CNodeCap x71 x72 x73 x74 \<and>* tcb_id \<mapsto>f tcb \<and>* (tcb_id, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (tcb_id, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* x71 \<mapsto>f CNode (empty_cnode root_size) \<and>* (x71, offset tcb_ref root_size) \<mapsto>c TcbCap tcb_id \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound; tcb_cap = TcbCap tcb_id; cnode_cap = CNodeCap x71 x72 x73 x74\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state s) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<longrightarrow>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c CNodeCap x71 x72 x73 x74 \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* tcb_id \<mapsto>f tcb \<and>* (tcb_id, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (tcb_id, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* x71 \<mapsto>f CNode (empty_cnode root_size) \<and>* (x71, offset tcb_ref root_size) \<mapsto>c TcbCap tcb_id \<and>* R)) (kernel_state s)
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)
 3. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id \<and> cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* \<box> (root_size, word_bits) : cnode_cap tcb_ref \<mapsto>u tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (2 subgoals):
 1. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s); cdl_current_thread (kernel_state s) = Some root_tcb_id; cdl_current_domain (kernel_state s) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* ?R221 cdl_tcb) (kernel_state s)
 2. \<And>cdl_tcb s. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; cdl.lift (root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) (kernel_state s)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb cdl_tcb \<and>* (\<lambda>s. True)) (kernel_state s) proof (prove)
goal (1 subgoal):
 1. \<And>cdl_tcb s sa sb. \<lbrakk>is_tcb_cap tcb_cap; tcb_id = cap_object tcb_cap; is_cnode_cap cnode_cap; one_lvl_lookup cnode_cap word_bits root_size; guard_equal cnode_cap tcb_ref word_bits; root_tcb = Tcb cdl_tcb; ((root_tcb_id, tcb_cspace_slot) \<mapsto>c cnode_cap \<and>* cap_object tcb_cap \<mapsto>f tcb \<and>* (cap_object tcb_cap, tcb_pending_op_slot) \<mapsto>c NullCap \<and>* (cap_object tcb_cap, tcb_boundntfn_slot) \<mapsto>c bound_ntfn_cap \<and>* cap_object cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object cnode_cap, offset tcb_ref root_size) \<mapsto>c tcb_cap \<and>* R) sb\<rbrakk> \<Longrightarrow> True proof (prove)
goal:
No subgoals!