theory TCB_DP

lemma invoke_tcb_ThreadControl_cur_thread:
  "\<lbrakk>\<forall>vcap capref. (vroot = Some (vcap,capref)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType
   ;\<forall>ccap capref. (croot = Some (ccap,capref)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType \<rbrakk>
   \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s))  and
    <(target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>*
     (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>*
     (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>*
     target_tcb \<mapsto>f Tcb tcb \<and>* R >
  \<rbrace> invoke_tcb (ThreadControl target_tcb tcb_cap_slot faultep croot vroot ipc_buffer)
  \<lbrace>\<lambda>_ s. P  (cdl_current_thread s) \<rbrace>" including no_pre apply (simp add:invoke_tcb_def comp_def) apply (wp whenE_wp
      tcb_empty_thread_slot_wp_inv
      [where R = "(target_tcb, tcb_vspace_slot) \<mapsto>c -
        \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c -
        \<and>* target_tcb \<mapsto>f - \<and>* R"] hoare_drop_imps
      |wpc
      |simp add:tcb_update_ipc_buffer_def
    tcb_update_thread_slot_def)+ apply (clarsimp simp:conj_comms) apply (rule hoare_post_impErr[OF valid_validE,rotated],assumption) apply (fastforce split:option.splits) apply (wp hoare_drop_imps whenE_wp
       | simp add: tcb_update_vspace_root_def tcb_update_thread_slot_def)+ apply (rule hoare_post_imp[OF _  insert_cap_child_wp]) apply (sep_erule_concl refl_imp sep_any_imp, assumption) apply wp apply (rule hoare_post_imp[OF _  insert_cap_sibling_wp]) apply (sep_erule_concl refl_imp sep_any_imp)+ apply (assumption) apply (rule_tac Q = "\<lambda>r s. P (cdl_current_thread s)
         \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c -
         \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c -
         \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
         \<and>* target_tcb \<mapsto>f - \<and>* R> s)
         " in hoare_post_imp) apply (clarsimp simp:sep_conj_ac) apply wp+ apply (rule_tac Q = "\<lambda>r s. P (cdl_current_thread s)
       \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c -
       \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c -
       \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
       \<and>* target_tcb \<mapsto>f - \<and>* R> s)
       " in hoare_post_impErr[rotated -1]) apply assumption apply (wp tcb_empty_thread_slot_wp_inv) apply clarsimp apply (sep_solve) apply (wp hoare_drop_imps whenE_wp
      | simp add: tcb_update_vspace_root_def tcb_update_thread_slot_def)+ apply (rule hoare_post_imp[OF _  insert_cap_child_wp]) apply (sep_select 2) apply (drule sep_map_c_any) apply assumption apply wp apply (rule hoare_post_imp[OF _ insert_cap_sibling_wp]) apply (sep_select 2) apply (drule sep_map_c_any) apply assumption apply (rule_tac Q = "\<lambda>r s. P (cdl_current_thread s)
        \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c -
        \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c -
        \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
        \<and>* target_tcb \<mapsto>f -
        \<and>* R> s)
        " in hoare_post_imp) apply (clarsimp simp:sep_conj_ac) apply wp+ apply (rule_tac Q = "\<lambda>r s. P (cdl_current_thread s)
       \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c -
       \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c -
       \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
       \<and>* target_tcb \<mapsto>f - \<and>* R> s)
       " in hoare_post_impErr[rotated -1]) apply assumption apply (wp tcb_empty_thread_slot_wp_inv) apply clarsimp apply sep_solve apply (rule_tac Q = "\<lambda>r s. P (cdl_current_thread s)
       \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c NullCap
      \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c -
      \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
      \<and>* target_tcb \<mapsto>f - \<and>* R> s)
       " in hoare_post_impErr[rotated -1]) apply assumption apply (wp whenE_wp |wpc|simp add:tcb_update_cspace_root_def)+ apply (wp hoare_drop_imps whenE_wp
        | simp add: tcb_update_vspace_root_def tcb_update_thread_slot_def)+ apply (rule hoare_post_imp[OF _  insert_cap_child_wp]) apply (sep_schem) apply wp apply (rule hoare_post_imp[OF _ insert_cap_sibling_wp], sep_schem) apply (rule_tac Q = "\<lambda>r s. P (cdl_current_thread s)
        \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c NullCap
        \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c -
        \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
        \<and>* target_tcb \<mapsto>f - \<and>* R> s)
        \<and> cap_type (fst x2) \<noteq> Some UntypedType" in hoare_post_imp) apply (clarsimp simp:sep_conj_ac, sep_solve) apply wp+ apply (rule_tac P = "cap_type (fst x2) \<noteq> Some UntypedType" in hoare_gen_asmEx) apply (rule_tac Q = "\<lambda>r s. P (cdl_current_thread s)
       \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c NullCap
       \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c -
       \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
       \<and>* target_tcb \<mapsto>f - \<and>* R> s)
       " in hoare_post_impErr[rotated -1]) apply clarsimp apply assumption apply (wp tcb_empty_thread_slot_wp_inv) apply clarsimp apply clarsimp apply (intro conjI impI impI allI) apply sep_solve+ apply (rule hoare_pre) apply (wp|wpc|simp)+ apply (rule_tac Q = "\<lambda>r s. P (cdl_current_thread s)
          \<and> (<(target_tcb, tcb_vspace_slot) \<mapsto>c NullCap
          \<and>* (target_tcb,tcb_cspace_slot) \<mapsto>c NullCap
          \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap
          \<and>* target_tcb \<mapsto>f - \<and>* R> s)" in hoare_post_imp) apply clarsimp apply (sep_select_asm 2) apply (intro conjI impI allI) apply sep_solve apply assumption+ apply sep_solve apply wp apply (rule hoare_post_imp[OF _ set_cdl_tcb_fault_endpoint_wp[where tcb = tcb]]) apply (drule sep_map_anyD) apply (sep_select 4) apply assumption apply clarsimp apply (auto, (sep_solve)+) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>vcap capref. vroot = Some (vcap, capref) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap capref. croot = Some (ccap, capref) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> invoke_tcb (ThreadControl target_tcb tcb_cap_slot faultep croot vroot ipc_buffer) \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>vcap capref. vroot = Some (vcap, capref) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap capref. croot = Some (ccap, capref) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> invoke_tcb (ThreadControl target_tcb tcb_cap_slot faultep croot vroot ipc_buffer) \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> doE y <- case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x));
y <- case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x;
y <- case vroot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root target_tcb tcb_cap_slot x;
case ipc_buffer of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot target_tcb tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent target_tcb
odE | Some x \<Rightarrow> tcb_update_ipc_buffer target_tcb tcb_cap_slot x
odE \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. x2 = (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R107 () () x2\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot x2 \<lbrace>\<lambda>yb s. (ipc_buffer = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> P (cdl_current_thread s)) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> P (cdl_current_thread s))\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?R107 y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R107 () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>yb s. (ipc_buffer = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?R107 y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a aa b e s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); (ipc_buffer = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrakk> \<Longrightarrow> P (cdl_current_thread s)
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R107 () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>_ s. (ipc_buffer = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 3. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?R107 y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R107 () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>_ s. (ipc_buffer = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?R107 y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>a aa b xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'152 a aa b () xa (TcbCap target_tcb)\<rbrace> insert_cap_child a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'151 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q147 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> ?P'152 a aa b x xa xb s) and ?P'151 a aa b x xa xb else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B145 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q147 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B145 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 7. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 8. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>a aa b xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R159 a aa b () xa (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'151 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q147 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R159 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'151 a aa b x xa xb else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B145 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q147 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B145 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 7. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 8. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'151 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q147 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'151 a aa b x xa xb else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B145 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q147 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B145 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'172 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q147 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> ?P'172 a aa b x xa xb s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B145 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q147 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B145 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R176 a aa b x xa xb) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q147 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R176 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B145 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q147 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B145 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa xb rv s sa sb sc sd. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; ?R'217 a aa b x xa xb sa sb sc sd\<rbrakk> \<Longrightarrow> R sd
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q147 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (\<lambda>sa. ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (\<lambda>sb. ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (\<lambda>sc. (target_tcb \<mapsto>f - \<and>* ?R'217 a aa b x xa xb sa sb sc) sc)) sb)) sa)) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B145 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q147 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B145 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q147 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 2. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B145 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q147 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B145 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a aa b x xa rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (if rv = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q147 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B145 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q147 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B145 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q147 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B145 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q147 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B145 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>x s. opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a aa b e s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); ?E233 a aa b e s\<rbrakk> \<Longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>?E233 a aa b\<rbrace>
 3. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P140 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 3. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 4. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ?P140 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a aa b s y. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; \<not> cdl_same_arch_obj_as a y; opt_cap (aa, b) s = Some y\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_update_vspace_root target_tcb tcb_cap_slot (a, aa, b) \<lbrace>\<lambda>rv s. (\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a aa b xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'293 a aa b () xa (TcbCap target_tcb)\<rbrace> insert_cap_child a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'292 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> ?P'293 a aa b x xa xb s) and ?P'292 a aa b x xa xb else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a aa b xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R300 a aa b () xa (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'292 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R300 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'292 a aa b x xa xb else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a aa b xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R300 a aa b () xa (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'292 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R300 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'292 a aa b x xa xb else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a aa b xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R300 a aa b () xa (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'292 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R300 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'292 a aa b x xa xb else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 4. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 6. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'292 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and ?P'292 a aa b x xa xb else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a aa b x xa xb. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'310 a aa b x xa xb\<rbrace> insert_cap_sibling a (aa, b) (target_tcb, tcb_vspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> ?P'310 a aa b x xa xb s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a aa b x xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R314 a aa b x xa xb) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R314 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a aa b x xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c a \<and>* ?R314 a aa b x xa xb) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R314 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a aa b x xa xb rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; xb = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R314 a aa b x xa xb) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* ?R314 a aa b x xa xb) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>xb. if xb = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>
 2. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>a aa b x xa rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (if rv = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and K (cap_type a \<noteq> Some UntypedType)) s) else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 2. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 5. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a aa b x xa. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); cdl_same_arch_obj_as a xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 a aa b x xa\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>a aa b x. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?B286 a aa b x\<rbrace> liftE (get_cap (aa, b)) \<lbrace>\<lambda>xa. if cdl_same_arch_obj_as a xa then ?Q288 a aa b x xa else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 3. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>?B286 a aa b\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 4. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>x s. opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s\<rbrace>, \<lbrace>\<lambda>rv a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a\<rbrace>
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a aa b e s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); ?E335 a aa b e s\<rbrakk> \<Longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>?E335 a aa b\<rbrace>
 3. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 4. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a aa b. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'139 a aa b (aa, b) () () (a, aa, b)\<rbrace> tcb_empty_thread_slot target_tcb tcb_vspace_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 3. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> ?P'139 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a aa b rv s. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (aa, b) s \<noteq> None \<longrightarrow> (if cdl_same_arch_obj_as a (the (opt_cap (aa, b) s)) then \<lambda>s. opt_cap tcb_cap_slot s \<noteq> None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s else (\<lambda>a. P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) a)) s
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a aa b s y. \<lbrakk>cap_type a \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; vroot = Some (a, aa, b); P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; \<not> cdl_same_arch_obj_as a y; opt_cap (aa, b) s = Some y\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>ya s. (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y ya x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>y e s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ?E383 y e s\<rbrakk> \<Longrightarrow> P (cdl_current_thread s)
 2. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>?E383 y\<rbrace>
 3. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?B4 y\<rbrace> case croot of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root target_tcb tcb_cap_slot x \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 2. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?B4\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 x2 () x\<rbrace> tcb_update_thread_slot target_tcb tcb_cap_slot tcb_cspace_slot x2 \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 2. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B400 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q402 x2 y x else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 3. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R394 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B400 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 4. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R394 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'408 x2 x (TcbCap target_tcb)\<rbrace> insert_cap_child (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'407 x2 x thread_cap\<rbrace> insert_cap_sibling (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> ?P'408 x2 x thread_cap s) and ?P'407 x2 x thread_cap else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 4. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B400 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q402 x2 y x else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 5. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R394 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B400 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 6. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R394 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>x2 x thread_cap rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb; cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<and>* ?R415 x2 x (TcbCap target_tcb)) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'407 x2 x thread_cap\<rbrace> insert_cap_sibling (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ?R415 x2 x thread_cap) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and ?P'407 x2 x thread_cap else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 4. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B400 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q402 x2 y x else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 5. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R394 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B400 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 6. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 7. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R394 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'407 x2 x thread_cap\<rbrace> insert_cap_sibling (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<longrightarrow>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and ?P'407 x2 x thread_cap else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 3. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B400 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q402 x2 y x else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 4. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R394 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B400 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 5. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R394 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>x2 x thread_cap. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); thread_cap = TcbCap target_tcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'431 x2 x thread_cap\<rbrace> insert_cap_sibling (fst x2) (snd x2) (target_tcb, tcb_cspace_slot) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<longrightarrow>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> ?P'431 x2 x thread_cap s) else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 3. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B400 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q402 x2 y x else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 4. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R394 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B400 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 5. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R394 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>thread_cap. if thread_cap = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<longrightarrow>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<longrightarrow>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 2. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B400 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q402 x2 y x else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 3. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R394 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B400 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 4. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R394 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>x2 x rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2); P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cap_type (fst x2) \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> (if rv = TcbCap target_tcb then (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<longrightarrow>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) and (\<lambda>s. P (cdl_current_thread s) \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* ((target_tcb, tcb_cspace_slot) \<mapsto>c fst x2 \<longrightarrow>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) and K (cap_type (fst x2) \<noteq> Some UntypedType)) s) else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s
 2. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cap_type (fst x2) \<noteq> Some UntypedType\<rbrace>
 3. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B400 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q402 x2 y x else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 4. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R394 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B400 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 5. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 6. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R394 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>x2 x. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; is_cnode_cap x \<and> cap_object x = cap_object (fst x2)\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 x2 () x\<rbrace> get_cap tcb_cap_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cap_type (fst x2) \<noteq> Some UntypedType\<rbrace>
 2. \<And>x2 y. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?B400 x2 y\<rbrace> liftE (get_cap (snd x2)) \<lbrace>\<lambda>x. if is_cnode_cap x \<and> cap_object x = cap_object (fst x2) then ?Q402 x2 y x else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 3. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R394 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>?B400 x2\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 4. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R394 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R394 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>\<lambda>y s. opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 2. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ?R394 y x s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'525 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>\<lambda>y s. opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s\<rbrace>, \<lbrace>\<lambda>e s. P (cdl_current_thread s)\<rbrace>
 2. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> (?P'525 y x and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>x2 e s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType; ?E526 x2 e s\<rbrakk> \<Longrightarrow> P (cdl_current_thread s)
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'525 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>?E526 x2\<rbrace>
 3. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s
 4. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> (?P'525 y x and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>a aa b e s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; cap_type a \<noteq> Some UntypedType; croot = Some (a, aa, b); ?E526 (a, aa, b) e s\<rbrakk> \<Longrightarrow> P (cdl_current_thread s)
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'525 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>?E526 x2\<rbrace>
 3. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s
 4. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 5. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> (?P'525 y x and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'525 () x2\<rbrace> tcb_empty_thread_slot target_tcb tcb_cspace_slot \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>, \<lbrace>\<lambda>a b. P (cdl_current_thread b)\<rbrace>
 2. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s
 3. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 4. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> (?P'525 y x and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. x2 = (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; croot = Some x2; cap_type (fst x2) \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> opt_cap (snd x2) s \<noteq> None \<longrightarrow> (if is_cnode_cap (the (opt_cap (snd x2) s)) \<and> cap_object (the (opt_cap (snd x2) s)) = cap_object (fst x2) then \<lambda>a. opt_cap tcb_cap_slot a \<noteq> None \<longrightarrow> P (cdl_current_thread a) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) a \<and> cap_type (fst x2) \<noteq> Some UntypedType else (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) s
 2. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 3. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 y x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 y x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 y x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>y rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> ((\<lambda>a. P (cdl_current_thread a)) and (\<lambda>s. (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. True)) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>s. P (cdl_current_thread s))) s)) s) \<and> (\<forall>x. ipc_buffer = Some x \<longrightarrow> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) s)) \<and> (\<forall>x. vroot = Some x \<longrightarrow> ((cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s) \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R)) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and (\<lambda>a. P (cdl_current_thread a))) s \<and> (cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 (fst x) (fst (snd x)) (snd (snd x)) (snd x) y rv x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) s)
 2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 y x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 y x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 y x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (vroot = None \<longrightarrow> (ipc_buffer = None \<longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. ipc_buffer = Some (a, aa, b)) \<longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s)) \<and> (\<forall>a aa b. vroot = Some (a, aa, b) \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R355 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R359 a aa b (aa, b) () () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)
 2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 y x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 y x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 y x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (15 subgoals):
 1. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = None; ipc_buffer = None\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = None; \<exists>a aa b. ipc_buffer = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 3. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R241 a aa b (aa, b) () () (a, aa, b)) s
 4. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R247 a aa b (aa, b) () () (a, aa, b)) s
 5. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* target_tcb \<mapsto>f - \<and>* R) s
 6. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R253 a aa b (aa, b) () () (a, aa, b)) s
 7. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R257 a aa b (aa, b) () () (a, aa, b)) s
 8. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 9. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R343 a aa b (aa, b) () () (a, aa, b)) s
 10. \<And>s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; vroot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* ?R349 a aa b (aa, b) () () (a, aa, b)) s
A total of 15 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 y x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 y x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 y x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?Q716\<rbrace> case faultep of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 y x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 y x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 y x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)\<rbrace>, \<lbrace>\<lambda>_ s. P (cdl_current_thread s)\<rbrace>
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> ?Q716 s proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'742 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>y s. (croot = None \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>a aa b. croot = Some (a, aa, b) \<longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () (a, aa, b)) s \<and> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () (a, aa, b)) s \<and> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)\<rbrace>
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and ?P'742 x) s) proof (prove)
goal (3 subgoals):
 1. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (croot = None \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>a aa b. croot = Some (a, aa, b) \<longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () (a, aa, b)) s \<and> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () (a, aa, b)) s \<and> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'742 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and ?P'742 x) s) proof (prove)
goal (3 subgoals):
 1. \<And>x2 s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (croot = None \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>a aa b. croot = Some (a, aa, b) \<longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'742 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and ?P'742 x) s) proof (prove)
goal (3 subgoals):
 1. \<And>x2 s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrakk> \<Longrightarrow> (croot = None \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>a aa b. croot = Some (a, aa, b) \<longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () (a, aa, b)) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'742 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and ?P'742 x) s) proof (prove)
goal (7 subgoals):
 1. \<And>x2 s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = None\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () (a, aa, b)) s
 3. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () (a, aa, b)) s
 4. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () (a, aa, b)) s
 5. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 6. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'742 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 7. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and ?P'742 x) s) proof (prove)
goal (6 subgoals):
 1. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () (a, aa, b)) s
 2. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () (a, aa, b)) s
 3. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () (a, aa, b)) s
 4. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 5. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'742 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 6. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R537 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R543 () x) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* ?R547 () x) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and ?P'742 x) s) proof (prove)
goal (3 subgoals):
 1. \<And>x2 s a aa b. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s; croot = Some (a, aa, b)\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'742 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 3. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and ?P'742 x) s) proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'742 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>r s. P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s\<rbrace>
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and ?P'742 x) s) proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?P'822 x2\<rbrace> update_thread target_tcb (cdl_tcb_fault_endpoint_update (\<lambda>_. x2)) \<lbrace>\<lambda>rv. cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)\<rbrace>
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and (\<lambda>s. P (cdl_current_thread s) \<and> ?P'822 x s)) s) proof (prove)
goal (2 subgoals):
 1. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; cdl.lift (target_tcb \<mapsto>f Tcb (tcb\<lparr>cdl_tcb_fault_endpoint := x2\<rparr>) \<and>* ?R826 x2) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift (target_tcb \<mapsto>f Tcb tcb \<and>* ?R826 x) s)) s) proof (prove)
goal (2 subgoals):
 1. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; cdl.lift (target_tcb \<mapsto>f - \<and>* ?R826 x2) s\<rbrakk> \<Longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift (target_tcb \<mapsto>f Tcb tcb \<and>* ?R826 x) s)) s) proof (prove)
goal (2 subgoals):
 1. \<And>x2 rv s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; faultep = Some x2; cdl.lift (target_tcb \<mapsto>f - \<and>* ?R826 x2) s\<rbrakk> \<Longrightarrow> cdl.lift (target_tcb \<mapsto>f - \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s
 2. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift (target_tcb \<mapsto>f Tcb tcb \<and>* ?R826 x) s)) s) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; ((\<lambda>s. P (cdl_current_thread s)) and cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R)) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> P (cdl_current_thread s) \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> (\<forall>x. croot = Some x \<longrightarrow> ((\<lambda>a. (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and (\<lambda>a. P (cdl_current_thread a))) a \<and> (cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) and cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R)) a) and K (cap_type (fst x) \<noteq> Some UntypedType)) s)) \<and> (\<forall>x. faultep = Some x \<longrightarrow> True \<and> ((\<lambda>s. croot = None \<longrightarrow> P (cdl_current_thread s)) and (\<lambda>s. P (cdl_current_thread s) \<and> cdl.lift (target_tcb \<mapsto>f Tcb tcb \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s)) s) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>\<forall>vcap. (\<exists>a b. vroot = Some (vcap, a, b)) \<longrightarrow> cap_type vcap \<noteq> Some UntypedType; \<forall>ccap. (\<exists>a b. croot = Some (ccap, a, b)) \<longrightarrow> cap_type ccap \<noteq> Some UntypedType; P (cdl_current_thread s); cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f Tcb tcb \<and>* R) s\<rbrakk> \<Longrightarrow> (faultep = None \<longrightarrow> (croot = None \<longrightarrow> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s) \<and> ((\<exists>a aa b. croot = Some (a, aa, b)) \<longrightarrow> cdl.lift ((target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s \<and> cdl.lift ((target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c - \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* target_tcb \<mapsto>f - \<and>* R) s)) \<and> ((\<exists>x. faultep = Some x) \<longrightarrow> cdl.lift (target_tcb \<mapsto>f Tcb tcb \<and>* (target_tcb, tcb_vspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_cspace_slot) \<mapsto>c NullCap \<and>* (target_tcb, tcb_ipcbuffer_slot) \<mapsto>c NullCap \<and>* R) s) proof (prove)
goal:
No subgoals!