theory TCB_DP

lemma invoke_tcb_ThreadControl_cdl_current_domain:
  "\<lbrakk>\<forall>vcap capref. (vroot = Some (vcap,capref)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType
   ;\<forall>ccap capref. (croot = Some (ccap,capref)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType \<rbrakk>
   \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_domain s))  and
    <(target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>*
     (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>*
     (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>*
     target_tcb \<mapsto>f Tcb tcb \<and>* R >
  \<rbrace> invoke_tcb (ThreadControl target_tcb tcb_cap_slot faultep croot vroot ipc_buffer)
  \<lbrace>\<lambda>_ s. P  (cdl_current_domain s) \<rbrace>" apply (simp add:invoke_tcb_def comp_def) apply (wp whenE_wp
      tcb_empty_thread_slot_wp_inv
      [where R = "(target_tcb, tcb_vspace_slot) \<mapsto>c -
        \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c -
        \<and>* target_tcb \<mapsto>f - \<and>* R"] hoare_drop_imps
      |wpc
      |simp add:tcb_update_ipc_buffer_def
    tcb_update_thread_slot_def)+ apply (clarsimp simp:conj_comms) apply (rule hoare_post_impErr[OF valid_validE,rotated],assumption) apply (fastforce split:option.splits) apply (wp hoare_drop_imps whenE_wp
       | simp add: tcb_update_vspace_root_def tcb_update_thread_slot_def)+ apply (rule hoare_post_imp[OF _  insert_cap_child_wp]) apply (sep_schem) apply wp apply (rule hoare_post_imp[OF _  insert_cap_sibling_wp]) apply (sep_schem) apply (rule_tac Q = "\<lambda>r s. P (cdl_current_domain s)
         \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c -
         \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c -
         \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
         \<and>* target_tcb \<mapsto>f - \<and>* R> s)
         " in hoare_post_imp) apply (clarsimp simp: sep_conj_ac, sep_solve) apply wp+ apply (rule_tac Q = "\<lambda>r s. P (cdl_current_domain s)
       \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c -
       \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c -
       \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
       \<and>* target_tcb \<mapsto>f - \<and>* R> s)
       " in hoare_post_impErr[rotated -1]) apply assumption apply (wp tcb_empty_thread_slot_wp_inv) apply clarsimp apply (sep_solve) apply (wp hoare_drop_imps whenE_wp
      | simp add: tcb_update_vspace_root_def tcb_update_thread_slot_def)+ apply (rule hoare_post_imp[OF _  insert_cap_child_wp]) apply (sep_select 2) apply (drule sep_map_c_any) apply assumption apply wp apply (rule hoare_post_imp[OF _ insert_cap_sibling_wp]) apply (sep_select 2) apply (drule sep_map_c_any) apply assumption apply (rule_tac Q = "\<lambda>r s. P (cdl_current_domain s)
        \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c -
        \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c -
        \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
        \<and>* target_tcb \<mapsto>f -
        \<and>* R> s)
        " in hoare_post_imp) apply (clarsimp simp:sep_conj_ac) apply wp+ apply (rule_tac Q = "\<lambda>r s. P (cdl_current_domain s)
       \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c -
       \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c -
       \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
       \<and>* target_tcb \<mapsto>f - \<and>* R> s)
       " in hoare_post_impErr[rotated -1]) apply assumption apply (wp tcb_empty_thread_slot_wp_inv) apply clarsimp apply sep_solve apply (rule_tac Q = "\<lambda>r s. P (cdl_current_domain s)
       \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c NullCap
      \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c -
      \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
      \<and>* target_tcb \<mapsto>f - \<and>* R> s)
       " in hoare_post_impErr[rotated -1]) apply assumption apply (wp whenE_wp |wpc|simp add:tcb_update_cspace_root_def)+ apply (wp hoare_drop_imps whenE_wp
        | simp add: tcb_update_vspace_root_def tcb_update_thread_slot_def)+ apply (rule hoare_post_imp[OF _  insert_cap_child_wp]) apply (sep_select 2) apply (drule sep_map_c_any) apply assumption apply wp apply (rule hoare_post_imp[OF _ insert_cap_sibling_wp]) apply (sep_select 2) apply (drule sep_map_c_any) apply assumption apply (rule_tac Q = "\<lambda>r s. P (cdl_current_domain s)
        \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c NullCap
        \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c -
        \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
        \<and>* target_tcb \<mapsto>f - \<and>* R> s)
        \<and> cap_type (fst x2) \<noteq> Some UntypedType" in hoare_post_imp) apply (clarsimp simp:sep_conj_ac) apply wp+ apply (rule_tac P = "cap_type (fst x2) \<noteq> Some UntypedType" in hoare_gen_asmEx) apply (rule_tac Q = "\<lambda>r s. P (cdl_current_domain s)
       \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c NullCap
       \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c -
       \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
       \<and>* target_tcb \<mapsto>f - \<and>* R> s)
       " in hoare_post_impErr[rotated -1]) apply clarsimp apply assumption apply (wp tcb_empty_thread_slot_wp_inv) apply clarsimp apply clarsimp apply (intro conjI impI impI allI) apply sep_solve+ apply (rule hoare_pre) apply (wp|wpc|simp)+ apply (rule_tac Q = "\<lambda>r s. P (cdl_current_domain s)
          \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c NullCap
          \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c NullCap
          \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
          \<and>* target_tcb \<mapsto>f - \<and>* R> s)" in hoare_post_imp) apply clarsimp apply (sep_select_asm 2) apply (intro conjI impI allI) apply sep_solve apply assumption+ apply sep_solve apply wp apply (rule hoare_post_imp[OF _ set_cdl_tcb_fault_endpoint_wp[where tcb = tcb]]) apply (drule sep_map_anyD) apply (sep_select 4) apply assumption+ apply clarsimp apply (auto, sep_solve+) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>vcap capref. vroot = Some (vcap, capref) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap capref. croot = Some (ccap, capref) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> invoke_tcb (ThreadControl target_tcb tcb_cap_slot faultep croot vroot ipc_buffer) \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> doE y <- case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x));
y <- case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x;
y <- case vroot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root target_tcb tcb_cap_slot x;
case ipc_buffer of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot target_tcb tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent target_tcb
odE | Some x \<Rightarrow> tcb_update_ipc_buffer target_tcb tcb_cap_slot x
odE \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. x2 = (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R108 () () x2\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot x2 \<lbrace>\<lambda>yb s. (ipc_buffer = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> P (cdl_current_domain s)) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> P (cdl_current_domain s))\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?R108 y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R108 () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>yb s. (ipc_buffer = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?R108 y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (5 subgoals):
 1. \<And>a aa b e s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); (ipc_buffer = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrakk> \<Longrightarrow> P (cdl_current_domain s)
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R108 () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>_ s. (ipc_buffer = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 3. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?R108 y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R108 () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>_ s. (ipc_buffer = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?R108 y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (9 subgoals):
 1. \<And>a aa b xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'153 a aa b () xa (TcbCap target_tcb)\<rbrace> insert_cap_child a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'152 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> ?P'153 a aa b x xa xb s) and ?P'152 a aa b x xa xb else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B146 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q148 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B146 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 7. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 9. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (9 subgoals):
 1. \<And>a aa b xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R160 a aa b () xa (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'152 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R160 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'152 a aa b x xa xb else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B146 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q148 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B146 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 7. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 9. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'152 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<longrightarrow>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'152 a aa b x xa xb else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B146 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q148 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B146 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'176 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<longrightarrow>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> ?P'176 a aa b x xa xb s) else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B146 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q148 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B146 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>a aa b x xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R180 a aa b x xa xb) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<longrightarrow>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R180 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B146 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q148 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B146 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<longrightarrow>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<longrightarrow>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 2. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B146 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q148 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B146 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>a aa b x xa rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (if rv = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<longrightarrow>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<longrightarrow>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B146 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q148 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B146 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B146 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q148 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B146 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (5 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>x s. opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>a aa b e s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); ?E280 a aa b e s\<rbrakk> \<Longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>?E280 a aa b\<rbrace>
 3. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (6 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P141 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 3. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 4. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P141 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (5 subgoals):
 1. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (5 subgoals):
 1. \<And>a aa b s y. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; \<not> cdl_same_arch_obj_as a y; opt_cap (aa, b) s = Some y\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>a aa b xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'340 a aa b () xa (TcbCap target_tcb)\<rbrace> insert_cap_child a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'339 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> ?P'340 a aa b x xa xb s) and ?P'339 a aa b x xa xb else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>a aa b xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R347 a aa b () xa (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'339 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R347 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'339 a aa b x xa xb else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>a aa b xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R347 a aa b () xa (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'339 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R347 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'339 a aa b x xa xb else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>a aa b xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R347 a aa b () xa (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'339 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R347 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'339 a aa b x xa xb else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'339 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'339 a aa b x xa xb else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'357 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> ?P'357 a aa b x xa xb s) else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R361 a aa b x xa xb) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R361 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R361 a aa b x xa xb) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R361 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R361 a aa b x xa xb) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R361 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (6 subgoals):
 1. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 2. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (if rv = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (6 subgoals):
 1. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q335 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B333 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q335 a aa b x xa else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B333 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>x s. opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (6 subgoals):
 1. \<And>a aa b e s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); ?E382 a aa b e s\<rbrakk> \<Longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>?E382 a aa b\<rbrace>
 3. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 4. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (5 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 3. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>a aa b s y. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; \<not> cdl_same_arch_obj_as a y; opt_cap (aa, b) s = Some y\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (3 subgoals):
 1. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (5 subgoals):
 1. \<And>y e s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?E430 y e s\<rbrakk> \<Longrightarrow> P (cdl_current_domain s)
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>?E430 y\<rbrace>
 3. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B5 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 2. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B5\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (6 subgoals):
 1. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> tcb_update_thread_slot target_tcb tcb_cap_slot tcb_cspace_slot x2 \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 2. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 3. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 4. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'455 x2 x (TcbCap target_tcb)\<rbrace> insert_cap_child (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'454 x2 x thread_cap\<rbrace> insert_cap_sibling (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> ?P'455 x2 x thread_cap s) and ?P'454 x2 x thread_cap else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 4. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 5. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 6. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>x2 x thread_cap rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<and>* ?R462 x2 x (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'454 x2 x thread_cap\<rbrace> insert_cap_sibling (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ?R462 x2 x thread_cap) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and ?P'454 x2 x thread_cap else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 4. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 5. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 6. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>x2 x thread_cap rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<and>* ?R462 x2 x (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'454 x2 x thread_cap\<rbrace> insert_cap_sibling (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ?R462 x2 x thread_cap) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and ?P'454 x2 x thread_cap else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 4. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 5. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 6. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>x2 x thread_cap rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ?R462 x2 x (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'454 x2 x thread_cap\<rbrace> insert_cap_sibling (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ?R462 x2 x thread_cap) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and ?P'454 x2 x thread_cap else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 4. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 5. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 6. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'454 x2 x thread_cap\<rbrace> insert_cap_sibling (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and ?P'454 x2 x thread_cap else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 3. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 4. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 5. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'472 x2 x thread_cap\<rbrace> insert_cap_sibling (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> ?P'472 x2 x thread_cap s) else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 3. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 4. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 5. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x thread_cap rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<and>* ?R476 x2 x thread_cap) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ?R476 x2 x thread_cap) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 3. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 4. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 5. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x thread_cap rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<and>* ?R476 x2 x thread_cap) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ?R476 x2 x thread_cap) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 3. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 4. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 5. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x thread_cap rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ?R476 x2 x thread_cap) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ?R476 x2 x thread_cap) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 3. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 4. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 5. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (6 subgoals):
 1. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 2. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 3. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 4. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cap_type (fst x2) \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> (if rv = TcbCap target_tcb then (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_domain s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s
 2. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cap_type (fst x2) \<noteq> Some UntypedType\<rbrace>
 3. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 4. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 5. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (6 subgoals):
 1. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q449 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cap_type (fst x2) \<noteq> Some UntypedType\<rbrace>
 2. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B447 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q449 x2 y x else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 3. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B447 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 4. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R441 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>\<lambda>y s. opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 2. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R441 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'499 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>\<lambda>y s. opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_domain s)\<rbrace>
 2. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> (?P'499 y x and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (6 subgoals):
 1. \<And>x2 e s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType; ?E500 x2 e s\<rbrakk> \<Longrightarrow> P (cdl_current_domain s)
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'499 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>?E500 x2\<rbrace>
 3. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s
 4. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> (?P'499 y x and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (6 subgoals):
 1. \<And>a aa b e s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; cap_type a \<noteq> Some UntypedType; croot = Some (a, aa, b); ?E500 (a, aa, b) e s\<rbrakk> \<Longrightarrow> P (cdl_current_domain s)
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'499 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>?E500 x2\<rbrace>
 3. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s
 4. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> (?P'499 y x and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (5 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'499 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>\<lambda>a b. P (cdl_current_domain b)\<rbrace>
 2. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s
 3. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> (?P'499 y x and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 5. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_domain a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s
 2. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 y x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 y x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 y x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (3 subgoals):
 1. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_domain a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_domain s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_domain a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 y x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 y x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 y x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s)) \<and> (\<forall>a aa b. vroot = Some (a, aa, b) \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R402 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R406 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)
 2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 y x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 y x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 y x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (16 subgoals):
 1. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = None; ipc_buffer = None\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = None; \<exists>a aa b. ipc_buffer = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 3. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R288 a aa b (aa, b) () () (a, aa, b)) s
 4. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R294 a aa b (aa, b) () () (a, aa, b)) s
 5. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 6. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R300 a aa b (aa, b) () () (a, aa, b)) s
 7. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R304 a aa b (aa, b) () () (a, aa, b)) s
 8. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 9. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R390 a aa b (aa, b) () () (a, aa, b)) s
 10. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R396 a aa b (aa, b) () () (a, aa, b)) s
A total of 16 subgoals... proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q3\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 y x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 y x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 y x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q690\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 y x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 y x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 y x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_domain s)\<rbrace>
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> ?Q690 s
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'716 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>a aa b. croot = Some (a, aa, b) \<longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () (a, aa, b)) s \<and> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () (a, aa, b)) s \<and> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and ?P'716 x) s)
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (croot = None \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>a aa b. croot = Some (a, aa, b) \<longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () (a, aa, b)) s \<and> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () (a, aa, b)) s \<and> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'716 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and ?P'716 x) s)
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>x2 s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (croot = None \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>a aa b. croot = Some (a, aa, b) \<longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'716 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and ?P'716 x) s)
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>x2 s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (croot = None \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>a aa b. croot = Some (a, aa, b) \<longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'716 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and ?P'716 x) s)
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (8 subgoals):
 1. \<And>x2 s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = None\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () (a, aa, b)) s
 3. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () (a, aa, b)) s
 4. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () (a, aa, b)) s
 5. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 6. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'716 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and ?P'716 x) s)
 8. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (7 subgoals):
 1. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () (a, aa, b)) s
 2. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () (a, aa, b)) s
 3. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () (a, aa, b)) s
 4. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 5. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'716 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R511 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R517 () x) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R521 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and ?P'716 x) s)
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (4 subgoals):
 1. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'716 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and ?P'716 x) s)
 4. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'716 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and ?P'716 x) s)
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'796 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and (\<lambda>s. P (cdl_current_domain s) \<and> ?P'796 x s)) s)
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (3 subgoals):
 1. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; cdl.lift (target_tcb \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := x2\<rparr>) \<and>* ?R800 x2) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift (target_tcb \<mapsto>f Tcb tcb \<and>* ?R800 x) s)) s)
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (3 subgoals):
 1. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; cdl.lift (target_tcb \<mapsto>f - \<and>* ?R800 x2) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift (target_tcb \<mapsto>f Tcb tcb \<and>* ?R800 x) s)) s)
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (3 subgoals):
 1. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; cdl.lift (target_tcb \<mapsto>f - \<and>* ?R800 x2) s\<rbrakk> \<Longrightarrow> cdl.lift (target_tcb \<mapsto>f - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?Q3 s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift (target_tcb \<mapsto>f Tcb tcb \<and>* ?R800 x) s)) s)
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q3 s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_domain s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_domain s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_domain a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_domain s)) and (\<lambda>s. P (cdl_current_domain s) \<and> cdl.lift (target_tcb \<mapsto>f Tcb tcb \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s)) s) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_domain s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. croot = Some (a, aa, b)) \<longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) \<and> ((\<exists>x. faultep = Some x) \<longrightarrow> cdl.lift (target_tcb \<mapsto>f Tcb tcb \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s) proof (prove)
goal:
No subgoals!