theory Tcb_DR

lemma dcorres_thread_control:
  notes option.case_cong_weak [cong]
  notes case_map_option [simp del]
  shows
  "\<lbrakk> t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer';
     t = translate_tcb_invocation t' \<rbrakk> \<Longrightarrow>
   dcorres (dc \<oplus> dc) \<top> (\<lambda>s. invs s \<and> valid_etcbs s \<and>
            not_idle_thread obj_id' s \<and>
            tcb_at obj_id' s \<and> valid_pdpt_objs s \<and>
            case_option (\<lambda>_. True) (valid_cap \<circ> fst) croot' s \<and>
            case_option True (Structures_A.is_cnode_cap \<circ> fst) croot' \<and>
            case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) croot' s \<and>
      (\<lambda>y.  case_option True (\<lambda>x. not_idle_thread (fst a') y) croot') s \<and>
            case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) croot' s \<and>
            case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) croot' s \<and>
      (\<lambda>y.  case_option True (\<lambda>x. not_idle_thread (fst a') y) vroot') s \<and>
            case_option True (is_valid_vtable_root \<circ> fst) vroot' \<and>
            case_option (\<lambda>_. True) (valid_cap \<circ> fst) vroot' s \<and>
            case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) vroot' s \<and>
            case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) vroot' s \<and>
            case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) vroot' s \<and>
            (\<lambda>s. case_option True (is_valid_vtable_root \<circ> fst) vroot') s \<and>
      (\<lambda>y.  case_option True (\<lambda>x. not_idle_thread (fst a') y) ipc_buffer') s \<and>
            case_option (\<lambda>_. True) (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) ipc_buffer' s \<and>
            case_option (\<lambda>_. True) (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) ipc_buffer' s \<and>
            (case ipc_buffer' of None \<Rightarrow> True
             | Some v \<Rightarrow> case_option True ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) (snd v)
            \<and> is_aligned (fst v) msg_align_bits)
          \<and> case_option (\<lambda>_. True) (\<lambda>a. case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) ipc_buffer' s
          \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits))
       (Tcb_D.invoke_tcb t) (Tcb_A.invoke_tcb t')"
  (is "\<lbrakk> ?eq; ?eq' \<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) \<top> ?P ?f ?g") apply (clarsimp simp: Tcb_D.invoke_tcb_def translate_tcb_invocation_def) apply (rule corres_guard_imp) apply (rule corres_splitEE[OF option_update_thread_corres]) apply (rule corres_dummy_returnOk_pl) apply (rule corres_splitEE[OF option_set_mcpriority_corres]) apply (rule corres_splitEE[OF dcorres_tcb_update_cspace_root]) apply (rule corres_splitEE[OF dcorres_tcb_update_vspace_root]) apply (rule dcorres_dummy_returnOk_pl') apply (rule corres_splitEE[where r'="dc" and P="\<top>"]) apply (rule corres_underlying_returnOk_ignored[THEN iffD1]) apply (rule dcorres_tcb_update_ipc_buffer) apply (rule dcorres_dummy_returnOk_pl') apply (rule corres_splitEE[where r'="dc" and P="\<top>"]) apply (rule option_set_priority_dcorres_strong) apply (rule dcorres_returnOk') apply (simp add: dc_def) apply wpsimp+ apply (rule check_cap_at_stable, (clarsimp simp: not_idle_thread_def | wp+)+)+ apply (wp case_option_wp | simp add: o_def not_idle_thread_def)+ apply (simp add: option.split[where P="\<lambda>x. x"] not_idle_thread_def) apply (wp hoare_vcg_const_imp_lift) apply (clarsimp simp: conj_comms) apply (clarsimp simp: not_idle_thread_def split: option.split_asm) apply (wp cap_delete_deletes cap_delete_valid_cap | simp)+ apply (strengthen tcb_cap_always_valid_strg use_no_cap_to_obj_asid_strg) apply (clarsimp simp: tcb_cap_cases_def) apply (strengthen is_cnode_or_valid_arch_cap_asid[simplified,THEN conjunct1]) apply (strengthen is_cnode_or_valid_arch_cap_asid[simplified,THEN conjunct2]) apply (wp cap_delete_deletes cap_delete_cte_at cap_delete_valid_cap
                    case_option_wpE
                 | simp add: not_idle_thread_def option.split[where P="\<lambda>x. x"])+ apply (rule_tac Q'="\<lambda>_. ?P" in hoare_post_imp_R[rotated]) apply (clarsimp simp: is_valid_vtable_root_def is_cnode_or_valid_arch_def
                               is_arch_cap_def not_idle_thread_def emptyable_def
                        split: option.splits) apply (wpc|wp|simp)+ apply (simp only: o_def) apply (wpe checked_insert_no_cap_to) apply (wpe hoare_case_option_wp[
                      where v=vroot' and f="\<lambda>_. f'" and
                            Q'="\<lambda>x rv. (no_cap_to_obj_dr_emp \<circ> fst) x" for f',
                      OF hoare_vcg_prop[where P=True],
                      simplified comp_apply,
                      OF checked_insert_no_cap_to]) apply (rule check_cap_at_stable, (clarsimp simp: not_idle_thread_def | wp+)+)+ apply (simp add: option.split[where P="\<lambda>x. x"] not_idle_thread_def) apply (wp hoare_vcg_const_imp_lift case_option_wp | simp add: not_idle_thread_def)+ apply (clarsimp simp: conj_comms) apply (intro conjI; clarsimp simp: not_idle_thread_def split: option.split) apply (wp cap_delete_deletes cap_delete_valid_cap)+ apply (strengthen tcb_cap_always_valid_strg use_no_cap_to_obj_asid_strg) apply (simp add: tcb_cap_cases_def) apply (strengthen is_cnode_or_valid_arch_cap_asid[simplified,THEN conjunct1]) apply (strengthen is_cnode_or_valid_arch_cap_asid[simplified,THEN conjunct2]) apply simp apply (wp cap_delete_deletes cap_delete_cte_at cap_delete_valid_cap)+ apply ((wp case_option_wpE cap_delete_valid_cap cap_delete_deletes cap_delete_cte_at
                  hoare_case_someE)+
                | simp add: not_idle_thread_def)+ apply (case_tac mcp', clarsimp, rule return_wp, clarsimp) subgoal by (wp case_option_wp dxo_wp_weak hoare_vcg_const_imp_lift hoare_vcg_all_lift
                  | simp add: option.split[where P="\<lambda>x. x"]
                  | intro conjI allI impI
                  | clarsimp split: option.split)+ apply (wp case_option_wpE)+ apply (rule_tac Q="\<lambda>_. ?P" in hoare_strengthen_post[rotated]) apply (clarsimp simp: is_valid_vtable_root_def is_cnode_or_valid_arch_def
                           is_arch_cap_def not_idle_thread_def emptyable_def
                    split: option.splits) apply (rule_tac P = "(case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)"
             in hoare_gen_asm) apply (wp out_invs_trivialT) apply (clarsimp simp: tcb_cap_cases_def)+ apply (wp case_option_wp out_cte_at out_valid_cap hoare_case_some | simp)+ apply (wp out_no_cap_to_trivial) apply (clarsimp simp: tcb_cap_cases_def) apply (wp case_option_wp out_cte_at out_valid_cap hoare_case_some | simp)+ apply (wp out_no_cap_to_trivial) apply (clarsimp simp: tcb_cap_cases_def) apply (wp case_option_wp out_cte_at out_valid_cap hoare_case_some | simp)+ by (clarsimp split: option.splits)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = translate_tcb_invocation t'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (\<lambda>s. invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) (Tcb_D.invoke_tcb t) (Tcb_A.invoke_tcb t') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (\<lambda>s. invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) (doE y <- case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x));
y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x;
y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x;
case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x
odE) (doE y <- liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep');
y <- liftE (case mcp' of None \<Rightarrow> return () | Some (newmcp, xa) \<Rightarrow> set_mcpriority obj_id' newmcp);
y <- case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE;
y <- case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE;
y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ?Q1 ?Q'1 (doE y <- case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x));
y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x;
y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x;
case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x
odE) (doE y <- liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep');
y <- liftE (case mcp' of None \<Rightarrow> return () | Some (newmcp, xa) \<Rightarrow> set_mcpriority obj_id' newmcp);
y <- case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE;
y <- case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE;
y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 2. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ?Q1 s
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> ?Q'1 s proof (prove)
goal (5 subgoals):
 1. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R5 y) (?R'5 ya) (doE y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x;
y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x;
case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x
odE) (doE y <- liftE (case mcp' of None \<Rightarrow> return () | Some (newmcp, xa) \<Rightarrow> set_mcpriority obj_id' newmcp);
y <- case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE;
y <- case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE;
y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?R5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>?R'5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 5. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (5 subgoals):
 1. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R5 y) (?R'5 ya) (doE _ <- returnOk (?b10 y ya);
y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x;
y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x;
case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x
odE) (doE y <- liftE (case mcp' of None \<Rightarrow> return () | Some (newmcp, xa) \<Rightarrow> set_mcpriority obj_id' newmcp);
y <- case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE;
y <- case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE;
y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>?R5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>?R'5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 5. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R12 y ya uu_) (?R'12 y ya yb) (doE y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x;
y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x;
case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x
odE) (doE y <- case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE;
y <- case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE;
y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>?R12 y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>?R'12 y ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (9 subgoals):
 1. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R19 y ya uu_ yb yc) (?R'19 y ya uu_ yb yd) (doE y <- case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x;
case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x
odE) (doE y <- case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE;
y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 2. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>?R19 y ya uu_ yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>?R'19 y ya uu_ yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (11 subgoals):
 1. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R35 y ya uu_ yb yc yd ye) (?R'35 y ya uu_ yb yc yd yf) (case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x) (doE y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 2. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 y ya uu_ yb yc\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>?R35 y ya uu_ yb yc yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'47 y ya uu_ yb yd\<rbrace> case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE \<lbrace>?R'35 y ya uu_ yb yc yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and ?Q37 y ya uu_ yb yc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and ?Q'47 y ya uu_ yb yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R35 y ya uu_ yb yc yd ye) (?R'35 y ya uu_ yb yc yd yf) (doE _ <- case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x;
returnOk ()
odE) (doE y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 2. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 y ya uu_ yb yc\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>?R35 y ya uu_ yb yc yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'47 y ya uu_ yb yd\<rbrace> case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE \<lbrace>?R'35 y ya uu_ yb yc yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and ?Q37 y ya uu_ yb yc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and ?Q'47 y ya uu_ yb yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (?P'55 y ya uu_ yb yc yd yf) (case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x) (case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE)
 2. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R53 y ya uu_ yb yc yd ye yf uua_) (?R'53 y ya uu_ yb yc yd ye yf yg) (returnOk ()) (doE y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 3. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q54 y ya uu_ yb yc yd ye\<rbrace> case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x \<lbrace>?R53 y ya uu_ yb yc yd ye yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'56 y ya uu_ yb yc yd yf\<rbrace> case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE \<lbrace>?R'53 y ya uu_ yb yc yd ye yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 y ya uu_ yb yc\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>ye. (\<lambda>_. True) and ?Q54 y ya uu_ yb yc yd ye\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'47 y ya uu_ yb yd\<rbrace> case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE \<lbrace>\<lambda>yf. ?P'55 y ya uu_ yb yc yd yf and ?Q'56 y ya uu_ yb yc yd yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and ?Q37 y ya uu_ yb yc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and ?Q'47 y ya uu_ yb yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (?P'55 y ya uu_ yb yc yd yf) (case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x) (doE _ <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
returnOk (?v62 y ya uu_ yb yc yd ye yf)
odE)
 2. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R53 y ya uu_ yb yc yd ye yf uua_) (?R'53 y ya uu_ yb yc yd ye yf yg) (returnOk ()) (doE y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 3. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q54 y ya uu_ yb yc yd ye\<rbrace> case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x \<lbrace>?R53 y ya uu_ yb yc yd ye yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'56 y ya uu_ yb yc yd yf\<rbrace> case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE \<lbrace>?R'53 y ya uu_ yb yc yd ye yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 y ya uu_ yb yc\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>ye. (\<lambda>_. True) and ?Q54 y ya uu_ yb yc yd ye\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'47 y ya uu_ yb yd\<rbrace> case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE \<lbrace>\<lambda>yf. ?P'55 y ya uu_ yb yc yd yf and ?Q'56 y ya uu_ yb yc yd yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and ?Q37 y ya uu_ yb yc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and ?Q'47 y ya uu_ yb yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R53 y ya uu_ yb yc yd ye yf uua_) (?R'53 y ya uu_ yb yc yd ye yf yg) (returnOk ()) (doE y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 2. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q54 y ya uu_ yb yc yd ye\<rbrace> case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x \<lbrace>?R53 y ya uu_ yb yc yd ye yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'56 y ya uu_ yb yc yd yf\<rbrace> case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE \<lbrace>?R'53 y ya uu_ yb yc yd ye yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 y ya uu_ yb yc\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>ye. (\<lambda>_. True) and ?Q54 y ya uu_ yb yc yd ye\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'47 y ya uu_ yb yd\<rbrace> case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE \<lbrace>\<lambda>yf. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) and (\<lambda>s. case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) and ?Q'56 y ya uu_ yb yc yd yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and ?Q37 y ya uu_ yb yc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and ?Q'47 y ya uu_ yb yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R53 y ya uu_ yb yc yd ye yf uua_) (?R'53 y ya uu_ yb yc yd ye yf yg) (doE _ <- returnOk ();
returnOk ()
odE) (doE y <- liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio));
returnOk []
odE)
 2. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q54 y ya uu_ yb yc yd ye\<rbrace> case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x \<lbrace>?R53 y ya uu_ yb yc yd ye yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'56 y ya uu_ yb yc yd yf\<rbrace> case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE \<lbrace>?R'53 y ya uu_ yb yc yd ye yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 y ya uu_ yb yc\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>ye. (\<lambda>_. True) and ?Q54 y ya uu_ yb yc yd ye\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'47 y ya uu_ yb yd\<rbrace> case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE \<lbrace>\<lambda>yf. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) and (\<lambda>s. case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) and ?Q'56 y ya uu_ yb yc yd yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and ?Q37 y ya uu_ yb yc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and ?Q'47 y ya uu_ yb yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (?P'76 y ya uu_ yb yc yd ye yf yg) (returnOk ()) (liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio)))
 2. \<And>y ya uu_ yb yc yd ye yf uua_ yg uub_ yh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg; dc uub_ yh\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R74 y ya uu_ yb yc yd ye yf uua_ yg uub_) (?R'74 y ya uu_ yb yc yd ye yf uua_ yg yh) (returnOk ()) (returnOk [])
 3. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 y ya uu_ yb yc yd ye yf uua_\<rbrace> returnOk () \<lbrace>?R74 y ya uu_ yb yc yd ye yf uua_ yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 y ya uu_ yb yc yd ye yf yg\<rbrace> liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio)) \<lbrace>?R'74 y ya uu_ yb yc yd ye yf uua_ yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q54 y ya uu_ yb yc yd ye\<rbrace> case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>uua_. (\<lambda>_. True) and ?Q75 y ya uu_ yb yc yd ye yf uua_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'56 y ya uu_ yb yc yd yf\<rbrace> case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE \<lbrace>\<lambda>yg. ?P'76 y ya uu_ yb yc yd ye yf yg and ?Q'77 y ya uu_ yb yc yd ye yf yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 y ya uu_ yb yc\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>ye. (\<lambda>_. True) and ?Q54 y ya uu_ yb yc yd ye\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'47 y ya uu_ yb yd\<rbrace> case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE \<lbrace>\<lambda>yf. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) and (\<lambda>s. case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) and ?Q'56 y ya uu_ yb yc yd yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and ?Q37 y ya uu_ yb yc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and ?Q'47 y ya uu_ yb yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y ya uu_ yb yc yd ye yf uua_ yg uub_ yh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg; dc uub_ yh\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R74 y ya uu_ yb yc yd ye yf uua_ yg uub_) (?R'74 y ya uu_ yb yc yd ye yf uua_ yg yh) (returnOk ()) (returnOk [])
 2. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 y ya uu_ yb yc yd ye yf uua_\<rbrace> returnOk () \<lbrace>?R74 y ya uu_ yb yc yd ye yf uua_ yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 y ya uu_ yb yc yd ye yf yg\<rbrace> liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio)) \<lbrace>?R'74 y ya uu_ yb yc yd ye yf uua_ yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q54 y ya uu_ yb yc yd ye\<rbrace> case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>uua_. (\<lambda>_. True) and ?Q75 y ya uu_ yb yc yd ye yf uua_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'56 y ya uu_ yb yc yd yf\<rbrace> case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE \<lbrace>\<lambda>yg. ?P'76 y ya uu_ yb yc yd ye yf yg and ?Q'77 y ya uu_ yb yc yd ye yf yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 y ya uu_ yb yc\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>ye. (\<lambda>_. True) and ?Q54 y ya uu_ yb yc yd ye\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'47 y ya uu_ yb yd\<rbrace> case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE \<lbrace>\<lambda>yf. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) and (\<lambda>s. case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) and ?Q'56 y ya uu_ yb yc yd yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and ?Q37 y ya uu_ yb yc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and ?Q'47 y ya uu_ yb yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y ya uu_ yb yc yd ye yf uua_ yg uub_ yh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg; dc uub_ yh\<rbrakk> \<Longrightarrow> dc () []
 2. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 y ya uu_ yb yc yd ye yf uua_\<rbrace> returnOk () \<lbrace>?R74 y ya uu_ yb yc yd ye yf uua_ yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 y ya uu_ yb yc yd ye yf yg\<rbrace> liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio)) \<lbrace>?R'74 y ya uu_ yb yc yd ye yf uua_ yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q54 y ya uu_ yb yc yd ye\<rbrace> case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>uua_. (\<lambda>_. True) and ?Q75 y ya uu_ yb yc yd ye yf uua_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'56 y ya uu_ yb yc yd yf\<rbrace> case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE \<lbrace>\<lambda>yg. ?P'76 y ya uu_ yb yc yd ye yf yg and ?Q'77 y ya uu_ yb yc yd ye yf yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 y ya uu_ yb yc\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>ye. (\<lambda>_. True) and ?Q54 y ya uu_ yb yc yd ye\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'47 y ya uu_ yb yd\<rbrace> case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE \<lbrace>\<lambda>yf. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) and (\<lambda>s. case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) and ?Q'56 y ya uu_ yb yc yd yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and ?Q37 y ya uu_ yb yc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and ?Q'47 y ya uu_ yb yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 y ya uu_ yb yc yd ye yf uua_\<rbrace> returnOk () \<lbrace>?R74 y ya uu_ yb yc yd ye yf uua_ yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>y ya uu_ yb yc yd ye yf uua_ yg. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf; dc uua_ yg\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 y ya uu_ yb yc yd ye yf yg\<rbrace> liftE (case prio' of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> do_extended_op (set_priority obj_id' prio)) \<lbrace>?R'74 y ya uu_ yb yc yd ye yf uua_ yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q54 y ya uu_ yb yc yd ye\<rbrace> case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>uua_. (\<lambda>_. True) and ?Q75 y ya uu_ yb yc yd ye yf uua_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb yc yd ye yf. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd; dc ye yf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'56 y ya uu_ yb yc yd yf\<rbrace> case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE \<lbrace>\<lambda>yg. ?P'76 y ya uu_ yb yc yd ye yf yg and ?Q'77 y ya uu_ yb yc yd ye yf yg\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q37 y ya uu_ yb yc\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_vspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>ye. (\<lambda>_. True) and ?Q54 y ya uu_ yb yc yd ye\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya uu_ yb yc yd. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb; dc yc yd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'47 y ya uu_ yb yd\<rbrace> case vroot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 1);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 1)
odE \<lbrace>\<lambda>yf. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) and (\<lambda>s. case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) and ?Q'56 y ya uu_ yb yc yd yf\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and ?Q37 y ya uu_ yb yc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and ?Q'47 y ya uu_ yb yd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x xa xb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (x, xa, xb)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap x, transform_cslot_ptr (xa, xb))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (x, xa, xb)\<rbrakk> \<Longrightarrow> \<lbrace>?P'397 xa xb () () () () () () (x, xa, xb) x (xa, xb) ()\<rbrace> check_cap_at x (xa, xb) (check_cap_at (ThreadCap obj_id') a' (cap_insert x (xa, xb) (obj_id', tcb_cnode_index (Suc 0)))) \<lbrace>\<lambda>rv s. valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>
 2. \<And>x xa xb xc xd xe xf xg xh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc x xa; dc xb xc; dc xd xe; vroot' = Some xf; xf = (xg, xh)\<rbrakk> \<Longrightarrow> \<lbrace>?R277 x xa xb xc xe xf xg xh\<rbrace> cap_delete (obj_id', tcb_cnode_index 1) \<lbrace>\<lambda>r s. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index (Suc 0)) and K (is_cnode_or_valid_arch xg) and (\<lambda>a. a \<turnstile> xg) and tcb_cap_valid xg (obj_id', tcb_cnode_index (Suc 0)) and K (local.is_pt_cap xg \<or> local.is_pd_cap xg \<longrightarrow> cap_asid xg \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs xg \<longrightarrow> table_cap_ref c = table_cap_ref xg \<and> pt_pd_asid c = pt_pd_asid xg) xh) s \<and> ?P'397 (fst xh) (snd xh) x xa xb xc xd xe xf xg xh r s\<rbrace>, \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R277 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 10. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (11 subgoals):
 1. \<And>x xa xb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (x, xa, xb)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap x, transform_cslot_ptr (xa, xb))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (x, xa, xb)\<rbrakk> \<Longrightarrow> \<lbrace>?P'418 x xa xb\<rbrace> cap_insert x (xa, xb) (obj_id', tcb_cnode_index (Suc 0)) \<lbrace>\<lambda>rv s. (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>
 2. \<And>x xa xb s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (x, xa, xb)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap x, transform_cslot_ptr (xa, xb))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (x, xa, xb); valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> ?P'418 x xa xb s
 3. \<And>x xa xb xc xd xe xf xg xh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc x xa; dc xb xc; dc xd xe; vroot' = Some xf; xf = (xg, xh)\<rbrakk> \<Longrightarrow> \<lbrace>?R277 x xa xb xc xe xf xg xh\<rbrace> cap_delete (obj_id', tcb_cnode_index 1) \<lbrace>\<lambda>r s. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index (Suc 0)) and K (is_cnode_or_valid_arch xg) and (\<lambda>a. a \<turnstile> xg) and tcb_cap_valid xg (obj_id', tcb_cnode_index (Suc 0)) and K (local.is_pt_cap xg \<or> local.is_pd_cap xg \<longrightarrow> cap_asid xg \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs xg \<longrightarrow> table_cap_ref c = table_cap_ref xg \<and> pt_pd_asid c = pt_pd_asid xg) xh) s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, \<lbrace>\<lambda>r s. True\<rbrace>
 4. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R277 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x xa xb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (x, xa, xb)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap x, transform_cslot_ptr (xa, xb))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (x, xa, xb)\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 x xa xb\<rbrace> cap_insert x (xa, xb) (obj_id', tcb_cnode_index (Suc 0)) \<lbrace>\<lambda>rv s. case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s\<rbrace>
 2. \<And>x xa xb s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (x, xa, xb)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap x, transform_cslot_ptr (xa, xb))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (x, xa, xb); valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some xc \<Rightarrow> case snd xc of None \<Rightarrow> \<lambda>_. True | Some xd \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd xd)) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some xc \<Rightarrow> case snd xc of None \<Rightarrow> \<lambda>_. True | Some xd \<Rightarrow> \<lambda>s. fst (snd xd) \<noteq> idle_thread s) s \<and> ?P'432 x xa xb s
 3. \<And>x xa xb xc xd xe xf xg xh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc x xa; dc xb xc; dc xd xe; vroot' = Some xf; xf = (xg, xh)\<rbrakk> \<Longrightarrow> \<lbrace>?R277 x xa xb xc xe xf xg xh\<rbrace> cap_delete (obj_id', tcb_cnode_index 1) \<lbrace>\<lambda>r s. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index (Suc 0)) and K (is_cnode_or_valid_arch xg) and (\<lambda>a. a \<turnstile> xg) and tcb_cap_valid xg (obj_id', tcb_cnode_index (Suc 0)) and K (local.is_pt_cap xg \<or> local.is_pd_cap xg \<longrightarrow> cap_asid xg \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs xg \<longrightarrow> table_cap_ref c = table_cap_ref xg \<and> pt_pd_asid c = pt_pd_asid xg) xh) s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, \<lbrace>\<lambda>r s. True\<rbrace>
 4. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R277 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x xa xb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (x, xa, xb)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap x, transform_cslot_ptr (xa, xb))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (x, xa, xb)\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 x xa xb\<rbrace> cap_insert x (xa, xb) (obj_id', tcb_cnode_index (Suc 0)) \<lbrace>\<lambda>rv s. (\<exists>a b. ipc_buffer' = Some (a, b)) \<longrightarrow> fst a' \<noteq> idle_thread s\<rbrace>
 2. \<And>x xa xb s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (x, xa, xb)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap x, transform_cslot_ptr (xa, xb))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (x, xa, xb); valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some xc \<Rightarrow> case snd xc of None \<Rightarrow> \<lambda>_. True | Some xd \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd xd)) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some xc \<Rightarrow> case snd xc of None \<Rightarrow> \<lambda>_. True | Some xd \<Rightarrow> \<lambda>s. fst (snd xd) \<noteq> idle_thread s) s \<and> ?P'432 x xa xb s
 3. \<And>x xa xb xc xd xe xf xg xh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc x xa; dc xb xc; dc xd xe; vroot' = Some xf; xf = (xg, xh)\<rbrakk> \<Longrightarrow> \<lbrace>?R277 x xa xb xc xe xf xg xh\<rbrace> cap_delete (obj_id', tcb_cnode_index 1) \<lbrace>\<lambda>r s. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index (Suc 0)) and K (is_cnode_or_valid_arch xg) and (\<lambda>a. a \<turnstile> xg) and tcb_cap_valid xg (obj_id', tcb_cnode_index (Suc 0)) and K (local.is_pt_cap xg \<or> local.is_pd_cap xg \<longrightarrow> cap_asid xg \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs xg \<longrightarrow> table_cap_ref c = table_cap_ref xg \<and> pt_pd_asid c = pt_pd_asid xg) xh) s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, \<lbrace>\<lambda>r s. True\<rbrace>
 4. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R277 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x xa xb s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (x, xa, xb)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap x, transform_cslot_ptr (xa, xb))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (x, xa, xb); valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some xc \<Rightarrow> case snd xc of None \<Rightarrow> \<lambda>_. True | Some xd \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd xd)) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some xc \<Rightarrow> case snd xc of None \<Rightarrow> \<lambda>_. True | Some xd \<Rightarrow> \<lambda>s. fst (snd xd) \<noteq> idle_thread s) s \<and> ((\<exists>a b. ipc_buffer' = Some (a, b)) \<longrightarrow> fst a' \<noteq> idle_thread s)
 2. \<And>x xa xb xc xd xe xf xg xh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc x xa; dc xb xc; dc xd xe; vroot' = Some xf; xf = (xg, xh)\<rbrakk> \<Longrightarrow> \<lbrace>?R277 x xa xb xc xe xf xg xh\<rbrace> cap_delete (obj_id', tcb_cnode_index 1) \<lbrace>\<lambda>r s. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index (Suc 0)) and K (is_cnode_or_valid_arch xg) and (\<lambda>a. a \<turnstile> xg) and tcb_cap_valid xg (obj_id', tcb_cnode_index (Suc 0)) and K (local.is_pt_cap xg \<or> local.is_pd_cap xg \<longrightarrow> cap_asid xg \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs xg \<longrightarrow> table_cap_ref c = table_cap_ref xg \<and> pt_pd_asid c = pt_pd_asid xg) xh) s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R277 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 10. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (10 subgoals):
 1. \<And>x xa xb s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (x, xa, xb)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap x, transform_cslot_ptr (xa, xb))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (x, xa, xb); tcb_at obj_id' s; obj_id' \<noteq> idle_thread s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s; (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s; (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s; case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits\<rbrakk> \<Longrightarrow> ((\<exists>a b. ipc_buffer' = Some (a, b)) \<longrightarrow> fst a' \<noteq> idle_thread s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some xc \<Rightarrow> case snd xc of None \<Rightarrow> \<lambda>_. True | Some xd \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd xd)) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some xc \<Rightarrow> case snd xc of None \<Rightarrow> \<lambda>_. True | Some xd \<Rightarrow> \<lambda>s. fst (snd xd) \<noteq> idle_thread s) s
 2. \<And>x xa xb xc xd xe xf xg xh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc x xa; dc xb xc; dc xd xe; vroot' = Some xf; xf = (xg, xh)\<rbrakk> \<Longrightarrow> \<lbrace>?R277 x xa xb xc xe xf xg xh\<rbrace> cap_delete (obj_id', tcb_cnode_index 1) \<lbrace>\<lambda>r s. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index (Suc 0)) and K (is_cnode_or_valid_arch xg) and (\<lambda>a. a \<turnstile> xg) and tcb_cap_valid xg (obj_id', tcb_cnode_index (Suc 0)) and K (local.is_pt_cap xg \<or> local.is_pd_cap xg \<longrightarrow> cap_asid xg \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs xg \<longrightarrow> table_cap_ref c = table_cap_ref xg \<and> pt_pd_asid c = pt_pd_asid xg) xh) s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R277 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 10. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (9 subgoals):
 1. \<And>x xa xb xc xd xe xf xg xh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc x xa; dc xb xc; dc xd xe; vroot' = Some xf; xf = (xg, xh)\<rbrakk> \<Longrightarrow> \<lbrace>?R277 x xa xb xc xe xf xg xh\<rbrace> cap_delete (obj_id', tcb_cnode_index 1) \<lbrace>\<lambda>r s. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index (Suc 0)) and K (is_cnode_or_valid_arch xg) and (\<lambda>a. a \<turnstile> xg) and tcb_cap_valid xg (obj_id', tcb_cnode_index (Suc 0)) and K (local.is_pt_cap xg \<or> local.is_pd_cap xg \<longrightarrow> cap_asid xg \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs xg \<longrightarrow> table_cap_ref c = table_cap_ref xg \<and> pt_pd_asid c = pt_pd_asid xg) xh) s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, \<lbrace>\<lambda>r s. True\<rbrace>
 2. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R277 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (9 subgoals):
 1. \<And>xf xg xh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (xg, xh)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap xg, transform_cslot_ptr xh)) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (xg, xh); xf = (xg, xh)\<rbrakk> \<Longrightarrow> \<lbrace>?P'520 () () () () () (xg, xh) xg xh\<rbrace> cap_delete (obj_id', tcb_cnode_index (Suc 0)) \<lbrace>\<lambda>rv s. tcb_cap_valid xg (obj_id', tcb_cnode_index (Suc 0)) s \<and> (local.is_pt_cap xg \<longrightarrow> (\<exists>y. cap_asid xg = Some y)) \<and> (local.is_pd_cap xg \<longrightarrow> (\<exists>y. cap_asid xg = Some y)) \<and> cte_wp_at (\<lambda>c. obj_refs c = obj_refs xg \<longrightarrow> table_cap_ref c = table_cap_ref xg \<and> pt_pd_asid c = pt_pd_asid xg) xh s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, -
 2. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 1)) s \<and> True \<and> is_cnode_or_valid_arch xa \<and> s \<turnstile> xa \<and> ?P'520 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (9 subgoals):
 1. \<And>xf xg xh. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (xg, xh)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap xg, transform_cslot_ptr xh)) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (xg, xh); xf = (xg, xh)\<rbrakk> \<Longrightarrow> \<lbrace>?P'520 () () () () () (xg, xh) xg xh\<rbrace> cap_delete (obj_id', tcb_cnode_index (Suc 0)) \<lbrace>\<lambda>r s. ((case tcb_cap_cases (tcb_cnode_index (Suc 0)) of None \<Rightarrow> True | Some (getF, setF, restr) \<Rightarrow> \<forall>st. restr obj_id' st xg) \<and> (tcb_cnode_index (Suc 0) = tcb_cnode_index 4 \<longrightarrow> (\<forall>ptr. valid_ipc_buffer_cap xg ptr))) \<and> (local.is_pt_cap xg \<longrightarrow> (\<exists>y. cap_asid xg = Some y)) \<and> (local.is_pd_cap xg \<longrightarrow> (\<exists>y. cap_asid xg = Some y)) \<and> (cte_wp_at (\<lambda>_. True) xh s \<and> no_cap_to_obj_dr_emp xg s \<and> s \<turnstile> xg \<and> invs s) \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, -
 2. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 1)) s \<and> True \<and> is_cnode_or_valid_arch xa \<and> s \<turnstile> xa \<and> ?P'520 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (9 subgoals):
 1. \<And>xg ab ba. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (xg, ab, ba)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap xg, transform_cslot_ptr (ab, ba))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (xg, ab, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?P'520 () () () () () (xg, ab, ba) xg (ab, ba)\<rbrace> cap_delete (obj_id', tcb_cnode_index (Suc 0)) \<lbrace>\<lambda>r s. (is_valid_vtable_root xg \<or> cap.NullCap = xg) \<and> (local.is_pt_cap xg \<longrightarrow> (\<exists>y. cap_asid xg = Some y)) \<and> (local.is_pd_cap xg \<longrightarrow> (\<exists>y. cap_asid xg = Some y)) \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp xg s \<and> s \<turnstile> xg \<and> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, -
 2. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 1)) s \<and> True \<and> is_cnode_or_valid_arch xa \<and> s \<turnstile> xa \<and> ?P'520 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (9 subgoals):
 1. \<And>xg ab ba. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (xg, ab, ba)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap xg, transform_cslot_ptr (ab, ba))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (xg, ab, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?P'520 () () () () () (xg, ab, ba) xg (ab, ba)\<rbrace> cap_delete (obj_id', tcb_cnode_index (Suc 0)) \<lbrace>\<lambda>r s. (is_valid_vtable_root xg \<or> cap.NullCap = xg) \<and> is_cnode_or_valid_arch xg \<and> (local.is_pd_cap xg \<longrightarrow> (\<exists>y. cap_asid xg = Some y)) \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp xg s \<and> s \<turnstile> xg \<and> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, -
 2. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 1)) s \<and> True \<and> is_cnode_or_valid_arch xa \<and> s \<turnstile> xa \<and> ?P'520 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (9 subgoals):
 1. \<And>xg ab ba. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' (Some (xg, ab, ba)) ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (Some (transform_cap xg, transform_cslot_ptr (ab, ba))) (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); vroot' = Some (xg, ab, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?P'520 () () () () () (xg, ab, ba) xg (ab, ba)\<rbrace> cap_delete (obj_id', tcb_cnode_index (Suc 0)) \<lbrace>\<lambda>r s. (is_valid_vtable_root xg \<or> cap.NullCap = xg) \<and> is_cnode_or_valid_arch xg \<and> is_cnode_or_valid_arch xg \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp xg s \<and> s \<turnstile> xg \<and> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)\<rbrace>, -
 2. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 y ya uu_\<rbrace> case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x \<lbrace>\<lambda>yc. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya uu_ yb. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya; dc uu_ yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 y ya yb\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd. invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (\<lambda>s. True \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> True \<and> K True s \<and> True \<and> True) \<and> (\<forall>x. vroot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 1)) s \<and> True \<and> is_cnode_or_valid_arch xa \<and> s \<turnstile> xa \<and> ?P'520 y ya uu_ yb yd x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>uu_. (\<lambda>_. True) and ?Q21 y ya uu_\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and ?Q'31 y ya yb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?P'709 () () ()\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>yd s. invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> ((\<exists>a aa b. vroot' = Some (a, aa, b)) \<longrightarrow> fst a' \<noteq> idle_thread s) \<and> (\<forall>a. (\<exists>aa b. vroot' = Some (a, aa, b)) \<longrightarrow> is_valid_vtable_root a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (\<forall>a b. ipc_buffer' = Some (a, b) \<longrightarrow> (\<forall>aa. (\<exists>a ba. b = Some (aa, a, ba)) \<longrightarrow> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa) \<and> is_aligned a msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> ((\<exists>a b. ipc_buffer' = Some (a, b)) \<longrightarrow> fst a' \<noteq> idle_thread s)) \<and> (\<forall>a aa b. vroot' = Some (a, aa, b) \<longrightarrow> invs s \<and> emptyable (obj_id', tcb_cnode_index (Suc 0)) s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> (is_valid_vtable_root a \<or> cap.NullCap = a) \<and> is_cnode_or_valid_arch a \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> invs s \<and> emptyable (obj_id', tcb_cnode_index (Suc 0)) s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (\<forall>a b. ipc_buffer' = Some (a, b) \<longrightarrow> (\<forall>aa. (\<exists>a ba. b = Some (aa, a, ba)) \<longrightarrow> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa) \<and> is_aligned a msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> ((\<exists>a b. ipc_buffer' = Some (a, b)) \<longrightarrow> fst a' \<noteq> idle_thread s))\<rbrace>, -
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> ?P'709 y ya yb s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (8 subgoals):
 1. \<And>rv s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> ((\<exists>a aa b. vroot' = Some (a, aa, b)) \<longrightarrow> fst a' \<noteq> idle_thread s) \<and> (\<forall>a. (\<exists>aa b. vroot' = Some (a, aa, b)) \<longrightarrow> is_valid_vtable_root a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (vroot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (\<forall>a b. ipc_buffer' = Some (a, b) \<longrightarrow> (\<forall>aa. (\<exists>a ba. b = Some (aa, a, ba)) \<longrightarrow> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa) \<and> is_aligned a msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> ((\<exists>a b. ipc_buffer' = Some (a, b)) \<longrightarrow> fst a' \<noteq> idle_thread s)) \<and> (\<forall>a aa b. vroot' = Some (a, aa, b) \<longrightarrow> invs s \<and> emptyable (obj_id', tcb_cnode_index (Suc 0)) s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> (is_valid_vtable_root a \<or> cap.NullCap = a) \<and> is_cnode_or_valid_arch a \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> invs s \<and> emptyable (obj_id', tcb_cnode_index (Suc 0)) s \<and> valid_etcbs s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (\<forall>a b. ipc_buffer' = Some (a, b) \<longrightarrow> (\<forall>aa. (\<exists>a ba. b = Some (aa, a, ba)) \<longrightarrow> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa) \<and> is_aligned a msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> ((\<exists>a b. ipc_buffer' = Some (a, b)) \<longrightarrow> fst a' \<noteq> idle_thread s))
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?P'709 () () ()\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>_ s. invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, -
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> ?P'709 y ya yb s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?P'709 () () ()\<rbrace> case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE \<lbrace>\<lambda>_ s. invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, -
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> ?P'709 y ya yb s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (8 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, x2a)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr x2a)) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1581 (x1, x2a) x1 x2a ()\<rbrace> check_cap_at x1 x2a (check_cap_at (ThreadCap obj_id') a' (cap_insert x1 x2a (obj_id', tcb_cnode_index 0))) \<lbrace>\<lambda>rv s. valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> no_cap_to_obj_dr_emp x1 s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>
 2. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1573 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a b. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) and K (is_cnode_or_valid_arch x1) and (\<lambda>a. a \<turnstile> x1) and tcb_cap_valid x1 (obj_id', tcb_cnode_index 0) and K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs x1 \<longrightarrow> table_cap_ref c = table_cap_ref x1 \<and> pt_pd_asid c = pt_pd_asid x1) x2a) b \<and> ?P'1581 x2 x1 x2a a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R1573 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (8 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, x2a)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr x2a)) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1581 (x1, x2a) x1 x2a ()\<rbrace> check_cap_at x1 x2a (check_cap_at (ThreadCap obj_id') a' (cap_insert x1 x2a (obj_id', tcb_cnode_index 0))) \<lbrace>\<lambda>rv s. valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> no_cap_to_obj_dr_emp x1 s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>
 2. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1573 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a b. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) and K (is_cnode_or_valid_arch x1) and (\<lambda>a. a \<turnstile> x1) and tcb_cap_valid x1 (obj_id', tcb_cnode_index 0) and K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs x1 \<longrightarrow> table_cap_ref c = table_cap_ref x1 \<and> pt_pd_asid c = pt_pd_asid x1) x2a) b \<and> ?P'1581 x2 x1 x2a a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R1573 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (8 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, x2a)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr x2a)) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1590 (x1, x2a) x1 x2a ()\<rbrace> check_cap_at x1 x2a (check_cap_at (ThreadCap obj_id') a' (cap_insert x1 x2a (obj_id', tcb_cnode_index 0))) \<lbrace>\<lambda>rv s. valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>
 2. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1573 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a b. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) and K (is_cnode_or_valid_arch x1) and (\<lambda>a. a \<turnstile> x1) and tcb_cap_valid x1 (obj_id', tcb_cnode_index 0) and K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs x1 \<longrightarrow> table_cap_ref c = table_cap_ref x1 \<and> pt_pd_asid c = pt_pd_asid x1) x2a) b \<and> (no_cap_to_obj_dr_emp x1 and no_cap_to_obj_dr_emp x1) b \<and> ?P'1590 x2 x1 x2a a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R1573 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (8 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, x2a)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr x2a)) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1607 (x1, x2a) x1 x2a ()\<rbrace> check_cap_at x1 x2a (check_cap_at (ThreadCap obj_id') a' (cap_insert x1 x2a (obj_id', tcb_cnode_index 0))) \<lbrace>\<lambda>rv s. valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>
 2. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1573 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a aa. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) and K (is_cnode_or_valid_arch x1) and (\<lambda>a. a \<turnstile> x1) and tcb_cap_valid x1 (obj_id', tcb_cnode_index 0) and K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs x1 \<longrightarrow> table_cap_ref c = table_cap_ref x1 \<and> pt_pd_asid c = pt_pd_asid x1) x2a) aa \<and> (no_cap_to_obj_dr_emp x1 and no_cap_to_obj_dr_emp x1) aa \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) aa \<and> ?P'1607 x2 x1 x2a a aa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R1573 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (9 subgoals):
 1. \<And>x1 ab ba. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, ab, ba)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr (ab, ba))) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, ab, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1637 x1 ab ba\<rbrace> cap_insert x1 (ab, ba) (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>rv s. (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>
 2. \<And>x1 ab ba s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, ab, ba)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr (ab, ba))) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, ab, ba); valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> ab \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> ab \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> ?P'1637 x1 ab ba s
 3. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1573 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a b. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) and K (is_cnode_or_valid_arch x1) and (\<lambda>a. a \<turnstile> x1) and tcb_cap_valid x1 (obj_id', tcb_cnode_index 0) and K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs x1 \<longrightarrow> table_cap_ref c = table_cap_ref x1 \<and> pt_pd_asid c = pt_pd_asid x1) x2a) b \<and> (no_cap_to_obj_dr_emp x1 and no_cap_to_obj_dr_emp x1) b \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) b \<and> valid_etcbs b \<and> not_idle_thread obj_id' b \<and> tcb_at obj_id' b \<and> (\<forall>x\<in>ran (kheap b). obj_valid_pdpt x) \<and> b \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) b \<and> not_idle_thread (fst a') b \<and> cte_wp_at (\<lambda>_. True) x2a b \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') b) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> \<lambda>a. a \<turnstile> fst x) b \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) b \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) b \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') b) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) b \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) b \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) b \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R1573 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (9 subgoals):
 1. \<And>x1 ab ba. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, ab, ba)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr (ab, ba))) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, ab, ba)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1637 x1 ab ba\<rbrace> cap_insert x1 (ab, ba) (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>rv s. ((\<exists>a aa b. vroot' = Some (a, aa, b)) \<longrightarrow> fst a' \<noteq> idle_thread s) \<and> (\<forall>a. (\<exists>aa b. vroot' = Some (a, aa, b)) \<longrightarrow> is_valid_vtable_root a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (\<forall>a. (\<exists>aa b. vroot' = Some (a, aa, b)) \<longrightarrow> is_valid_vtable_root a) \<and> ((\<exists>a b. ipc_buffer' = Some (a, b)) \<longrightarrow> fst a' \<noteq> idle_thread s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (\<forall>a b. ipc_buffer' = Some (a, b) \<longrightarrow> (\<forall>aa. (\<exists>a ba. b = Some (aa, a, ba)) \<longrightarrow> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa) \<and> is_aligned a msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (\<forall>x2. fault_ep' = Some x2 \<longrightarrow> length x2 = word_bits)\<rbrace>
 2. \<And>x1 ab ba s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, ab, ba)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr (ab, ba))) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, ab, ba); valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> ab \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> ab \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> ?P'1637 x1 ab ba s
 3. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1573 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a b. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) and K (is_cnode_or_valid_arch x1) and (\<lambda>a. a \<turnstile> x1) and tcb_cap_valid x1 (obj_id', tcb_cnode_index 0) and K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs x1 \<longrightarrow> table_cap_ref c = table_cap_ref x1 \<and> pt_pd_asid c = pt_pd_asid x1) x2a) b \<and> (no_cap_to_obj_dr_emp x1 and no_cap_to_obj_dr_emp x1) b \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) b \<and> valid_etcbs b \<and> not_idle_thread obj_id' b \<and> tcb_at obj_id' b \<and> (\<forall>x\<in>ran (kheap b). obj_valid_pdpt x) \<and> b \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) b \<and> not_idle_thread (fst a') b \<and> cte_wp_at (\<lambda>_. True) x2a b \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') b) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> \<lambda>a. a \<turnstile> fst x) b \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) b \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) b \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') b) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) b \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) b \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) b \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R1573 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 9. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (8 subgoals):
 1. \<And>x1 ab ba s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, ab, ba)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr (ab, ba))) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, ab, ba); valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> ab \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (\<forall>a. (\<exists>aa b. vroot' = Some (a, aa, b)) \<longrightarrow> is_valid_vtable_root a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> \<lambda>s. fst (snd x) \<noteq> idle_thread s) s \<and> (\<forall>a. (\<exists>aa b. vroot' = Some (a, aa, b)) \<longrightarrow> is_valid_vtable_root a) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some xa \<Rightarrow> \<lambda>s. fst (snd xa) \<noteq> idle_thread s) s \<and> (\<forall>a b. ipc_buffer' = Some (a, b) \<longrightarrow> (\<forall>aa. (\<exists>a ba. b = Some (aa, a, ba)) \<longrightarrow> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa) \<and> is_aligned a msg_align_bits) \<and> (\<forall>x2. fault_ep' = Some x2 \<longrightarrow> length x2 = word_bits)
 2. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1573 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a b. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) and K (is_cnode_or_valid_arch x1) and (\<lambda>a. a \<turnstile> x1) and tcb_cap_valid x1 (obj_id', tcb_cnode_index 0) and K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs x1 \<longrightarrow> table_cap_ref c = table_cap_ref x1 \<and> pt_pd_asid c = pt_pd_asid x1) x2a) b \<and> (no_cap_to_obj_dr_emp x1 and no_cap_to_obj_dr_emp x1) b \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) b \<and> valid_etcbs b \<and> not_idle_thread obj_id' b \<and> tcb_at obj_id' b \<and> (\<forall>x\<in>ran (kheap b). obj_valid_pdpt x) \<and> b \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) b \<and> not_idle_thread (fst a') b \<and> cte_wp_at (\<lambda>_. True) x2a b \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') b) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> \<lambda>a. a \<turnstile> fst x) b \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) b \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) b \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') b) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) b \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) b \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) b \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R1573 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (8 subgoals):
 1. \<And>x1 ab ba s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, ab, ba)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr (ab, ba))) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, ab, ba); Structures_A.is_cnode_cap x1; s \<turnstile> x1; tcb_at obj_id' s; ab \<noteq> idle_thread s; obj_id' \<noteq> idle_thread s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; fst a' \<noteq> idle_thread s; cte_wp_at (\<lambda>_. True) (ab, ba) s; case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits; case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s; case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s; (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s; (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s; (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s; (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s; (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s; case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits\<rbrakk> \<Longrightarrow> (\<forall>x2. fault_ep' = Some x2 \<longrightarrow> length x2 = word_bits) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> \<lambda>s. fst (snd x) \<noteq> idle_thread s) s \<and> (\<forall>a. (\<exists>aa b. vroot' = Some (a, aa, b)) \<longrightarrow> is_valid_vtable_root a) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some xa \<Rightarrow> \<lambda>s. fst (snd xa) \<noteq> idle_thread s) s \<and> (\<forall>a b. ipc_buffer' = Some (a, b) \<longrightarrow> is_aligned a msg_align_bits \<and> (\<forall>aa. (\<exists>a ba. b = Some (aa, a, ba)) \<longrightarrow> cap_aligned aa \<and> is_arch_cap aa \<and> valid_ipc_buffer_cap aa a))
 2. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1573 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a b. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) and K (is_cnode_or_valid_arch x1) and (\<lambda>a. a \<turnstile> x1) and tcb_cap_valid x1 (obj_id', tcb_cnode_index 0) and K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs x1 \<longrightarrow> table_cap_ref c = table_cap_ref x1 \<and> pt_pd_asid c = pt_pd_asid x1) x2a) b \<and> (no_cap_to_obj_dr_emp x1 and no_cap_to_obj_dr_emp x1) b \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) b \<and> valid_etcbs b \<and> not_idle_thread obj_id' b \<and> tcb_at obj_id' b \<and> (\<forall>x\<in>ran (kheap b). obj_valid_pdpt x) \<and> b \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) b \<and> not_idle_thread (fst a') b \<and> cte_wp_at (\<lambda>_. True) x2a b \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') b) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> \<lambda>a. a \<turnstile> fst x) b \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) b \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) b \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') b) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) b \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) b \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) b \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R1573 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 8. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1573 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a b. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) and K (is_cnode_or_valid_arch x1) and (\<lambda>a. a \<turnstile> x1) and tcb_cap_valid x1 (obj_id', tcb_cnode_index 0) and K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs x1 \<longrightarrow> table_cap_ref c = table_cap_ref x1 \<and> pt_pd_asid c = pt_pd_asid x1) x2a) b \<and> (no_cap_to_obj_dr_emp x1 and no_cap_to_obj_dr_emp x1) b \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) b \<and> valid_etcbs b \<and> not_idle_thread obj_id' b \<and> tcb_at obj_id' b \<and> (\<forall>x\<in>ran (kheap b). obj_valid_pdpt x) \<and> b \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) b \<and> not_idle_thread (fst a') b \<and> cte_wp_at (\<lambda>_. True) x2a b \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') b) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> \<lambda>a. a \<turnstile> fst x) b \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) b \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) b \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') b) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) b \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) b \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) b \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R1573 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1809 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>rv s. tcb_cap_valid x1 (obj_id', tcb_cnode_index 0) s \<and> K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) s \<and> cte_wp_at (\<lambda>c. obj_refs c = obj_refs x1 \<longrightarrow> table_cap_ref c = table_cap_ref x1 \<and> pt_pd_asid c = pt_pd_asid x1) x2a s \<and> (no_cap_to_obj_dr_emp x1 and no_cap_to_obj_dr_emp x1) s \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> \<lambda>a. a \<turnstile> fst x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, -
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) s \<and> True \<and> K (is_cnode_or_valid_arch xa) s \<and> s \<turnstile> xa \<and> ?P'1809 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1809 () () () x2 x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>r s. ((case tcb_cap_cases (tcb_cnode_index 0) of None \<Rightarrow> True | Some (getF, setF, restr) \<Rightarrow> \<forall>st. restr obj_id' st x1) \<and> (tcb_cnode_index 0 = tcb_cnode_index 4 \<longrightarrow> (\<forall>ptr. valid_ipc_buffer_cap x1 ptr))) \<and> K (local.is_pt_cap x1 \<or> local.is_pd_cap x1 \<longrightarrow> cap_asid x1 \<noteq> None) s \<and> (cte_wp_at (\<lambda>_. True) x2a s \<and> no_cap_to_obj_dr_emp x1 s \<and> s \<turnstile> x1 \<and> invs s) \<and> (no_cap_to_obj_dr_emp x1 and no_cap_to_obj_dr_emp x1) s \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> \<lambda>a. a \<turnstile> fst x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, -
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) s \<and> True \<and> K (is_cnode_or_valid_arch xa) s \<and> s \<turnstile> xa \<and> ?P'1809 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, x2a)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr x2a)) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1809 () () () (x1, x2a) x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>r s. (local.is_pt_cap x1 \<longrightarrow> (\<exists>y. cap_asid x1 = Some y)) \<and> (local.is_pd_cap x1 \<longrightarrow> (\<exists>y. cap_asid x1 = Some y)) \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> no_cap_to_obj_dr_emp x1 s \<and> s \<turnstile> x1 \<and> invs s \<and> no_cap_to_obj_dr_emp x1 s \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> Ball (ran (kheap s)) obj_valid_pdpt \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, -
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) s \<and> True \<and> K (is_cnode_or_valid_arch xa) s \<and> s \<turnstile> xa \<and> ?P'1809 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, x2a)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr x2a)) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1809 () () () (x1, x2a) x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>r s. is_cnode_or_valid_arch x1 \<and> (local.is_pd_cap x1 \<longrightarrow> (\<exists>y. cap_asid x1 = Some y)) \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> no_cap_to_obj_dr_emp x1 s \<and> s \<turnstile> x1 \<and> invs s \<and> no_cap_to_obj_dr_emp x1 s \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> Ball (ran (kheap s)) obj_valid_pdpt \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, -
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) s \<and> True \<and> K (is_cnode_or_valid_arch xa) s \<and> s \<turnstile> xa \<and> ?P'1809 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, x2a)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr x2a)) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1809 () () () (x1, x2a) x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>r s. is_cnode_or_valid_arch x1 \<and> is_cnode_or_valid_arch x1 \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> no_cap_to_obj_dr_emp x1 s \<and> s \<turnstile> x1 \<and> invs s \<and> no_cap_to_obj_dr_emp x1 s \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> Ball (ran (kheap s)) obj_valid_pdpt \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, -
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) s \<and> True \<and> K (is_cnode_or_valid_arch xa) s \<and> s \<turnstile> xa \<and> ?P'1809 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, x2a)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr x2a)) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1809 () () () (x1, x2a) x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>r s. is_cnode_or_valid_arch x1 \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> no_cap_to_obj_dr_emp x1 s \<and> s \<turnstile> x1 \<and> invs s \<and> no_cap_to_obj_dr_emp x1 s \<and> (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> Ball (ran (kheap s)) obj_valid_pdpt \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, -
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) s \<and> True \<and> K (is_cnode_or_valid_arch xa) s \<and> s \<turnstile> xa \<and> ?P'1809 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' (Some (x1, x2a)) vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (Some (transform_cap x1, transform_cslot_ptr x2a)) (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); croot' = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1880 () () () (x1, x2a) x1 x2a\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>rv s. (case vroot' of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x) and no_cap_to_obj_dr_emp x1) s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> Ball (ran (kheap s)) obj_valid_pdpt \<and> s \<turnstile> x1 \<and> Structures_A.is_cnode_cap x1 \<and> not_idle_thread (fst x2a) s \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) x2a s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x))) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>, -
 2. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 y\<rbrace> returnOk () \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y ya. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 ya\<rbrace> liftE (case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp) \<lbrace>\<lambda>yb. invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and (\<lambda>s. True \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>x. croot' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) s \<and> True \<and> K (is_cnode_or_valid_arch xa) s \<and> s \<turnstile> xa \<and> is_cnode_or_valid_arch xa \<and> cte_wp_at (\<lambda>_. True) xb s \<and> no_cap_to_obj_dr_emp xa s \<and> s \<turnstile> xa \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) s \<and> no_cap_to_obj_dr_emp xa s \<and> ?P'1880 y ya yb x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q14 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and ?Q'15 ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 7. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?P'2119 ()\<rbrace> case mcp' of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority obj_id' mcp \<lbrace>\<lambda>yb s. invs s \<and> valid_etcbs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>a aa b. croot' = Some (a, aa, b) \<longrightarrow> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> is_cnode_or_valid_arch a \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp a s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some b \<Rightarrow> \<lambda>c. no_cap_to_obj_dr_emp (fst b) c \<and> no_cap_to_obj_dr_emp a c) s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> a \<and> Structures_A.is_cnode_cap a \<and> aa \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_cap (fst a)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits))\<rbrace>
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. True \<and> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and (\<lambda>s. True \<and> ?P'2119 ya s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 5. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' (Some (a, b)) prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); mcp' = Some (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> (\<forall>x\<in>ran (kheap a). obj_valid_pdpt x) \<and> obj_id' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) a \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') a) \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) a \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) a \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) a \<and> (croot' = None \<longrightarrow> invs a \<and> valid_etcbs a \<and> obj_id' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> (\<forall>x\<in>ran (kheap a). obj_valid_pdpt x) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') a) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) a \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') a) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) a \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) a \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) a \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>aa aaa b. croot' = Some (aa, aaa, b) \<longrightarrow> invs a \<and> emptyable (obj_id', tcb_cnode_index 0) a \<and> is_cnode_or_valid_arch aa \<and> a \<turnstile> aa \<and> is_cnode_or_valid_arch aa \<and> cte_wp_at (\<lambda>_. True) (aaa, b) a \<and> no_cap_to_obj_dr_emp aa a \<and> a \<turnstile> aa \<and> invs a \<and> emptyable (obj_id', tcb_cnode_index 0) a \<and> no_cap_to_obj_dr_emp aa a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some b \<Rightarrow> \<lambda>a. no_cap_to_obj_dr_emp (fst b) a \<and> no_cap_to_obj_dr_emp aa a) a \<and> valid_etcbs a \<and> obj_id' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> (\<forall>x\<in>ran (kheap a). obj_valid_pdpt x) \<and> a \<turnstile> aa \<and> Structures_A.is_cnode_cap aa \<and> aaa \<noteq> idle_thread a \<and> fst a' \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (aaa, b) a \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread a) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_cap (fst a)) a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) a \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread a) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) a \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) a \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) a \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits))\<rbrace> set_mcpriority obj_id' a \<lbrace>\<lambda>yb s. invs s \<and> valid_etcbs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>a aa b. croot' = Some (a, aa, b) \<longrightarrow> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> is_cnode_or_valid_arch a \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp a s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some b \<Rightarrow> \<lambda>c. no_cap_to_obj_dr_emp (fst b) c \<and> no_cap_to_obj_dr_emp a c) s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> a \<and> Structures_A.is_cnode_cap a \<and> aa \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_cap (fst a)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits))\<rbrace>
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. True \<and> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and (\<lambda>s. True \<and> invs s \<and> valid_etcbs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>a aa b. croot' = Some (a, aa, b) \<longrightarrow> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> is_cnode_or_valid_arch a \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp a s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some b \<Rightarrow> \<lambda>c. no_cap_to_obj_dr_emp (fst b) c \<and> no_cap_to_obj_dr_emp a c) s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> a \<and> Structures_A.is_cnode_cap a \<and> aa \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. b \<turnstile> fst a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 5. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' (Some (a_, b_)) prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); mcp' = Some (a_, b_)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> (\<forall>x\<in>ran (kheap a). obj_valid_pdpt x) \<and> obj_id' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) a \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') a) \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) a \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) a \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) a \<and> (croot' = None \<longrightarrow> invs a \<and> valid_etcbs a \<and> obj_id' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> (\<forall>x\<in>ran (kheap a). obj_valid_pdpt x) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') a) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) a \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') a) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) a \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) a \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) a \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>aa aaa b. croot' = Some (aa, aaa, b) \<longrightarrow> invs a \<and> emptyable (obj_id', tcb_cnode_index 0) a \<and> is_cnode_or_valid_arch aa \<and> a \<turnstile> aa \<and> is_cnode_or_valid_arch aa \<and> cte_wp_at (\<lambda>_. True) (aaa, b) a \<and> no_cap_to_obj_dr_emp aa a \<and> a \<turnstile> aa \<and> invs a \<and> emptyable (obj_id', tcb_cnode_index 0) a \<and> no_cap_to_obj_dr_emp aa a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some b \<Rightarrow> \<lambda>a. no_cap_to_obj_dr_emp (fst b) a \<and> no_cap_to_obj_dr_emp aa a) a \<and> valid_etcbs a \<and> obj_id' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> (\<forall>x\<in>ran (kheap a). obj_valid_pdpt x) \<and> a \<turnstile> aa \<and> Structures_A.is_cnode_cap aa \<and> aaa \<noteq> idle_thread a \<and> fst a' \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (aaa, b) a \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread a) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_cap (fst a)) a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) a \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) a \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread a) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) a \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) a \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) a \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits))\<rbrace> set_mcpriority obj_id' a_ \<lbrace>\<lambda>yb s. invs s \<and> valid_etcbs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>a aa b. croot' = Some (a, aa, b) \<longrightarrow> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> is_cnode_or_valid_arch a \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp a s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some b \<Rightarrow> \<lambda>c. no_cap_to_obj_dr_emp (fst b) c \<and> no_cap_to_obj_dr_emp a c) s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> a \<and> Structures_A.is_cnode_cap a \<and> aa \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_cap (fst a)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits))\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q5\<rbrace> case map_option of_bl fault_ep' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> liftE $ update_thread obj_id' (cdl_tcb_fault_endpoint_update (\<lambda>_. x)) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. True \<and> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'5\<rbrace> liftE (option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep') \<lbrace>\<lambda>ya. valid_etcbs and (\<lambda>s. True \<and> invs s \<and> valid_etcbs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>a aa b. croot' = Some (a, aa, b) \<longrightarrow> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> is_cnode_or_valid_arch a \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp a s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some b \<Rightarrow> \<lambda>c. no_cap_to_obj_dr_emp (fst b) c \<and> no_cap_to_obj_dr_emp a c) s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> a \<and> Structures_A.is_cnode_cap a \<and> aa \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. b \<turnstile> fst a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q5) s
 4. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and ?Q'5) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?P'2180\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv s. invs s \<and> valid_etcbs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>a aa b. croot' = Some (a, aa, b) \<longrightarrow> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> is_cnode_or_valid_arch a \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp a s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some b \<Rightarrow> \<lambda>c. no_cap_to_obj_dr_emp (fst b) c \<and> no_cap_to_obj_dr_emp a c) s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> a \<and> Structures_A.is_cnode_cap a \<and> aa \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. b \<turnstile> fst a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits))\<rbrace>
 2. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> ?P'2180 s)) s proof (prove)
goal (4 subgoals):
 1. \<And>rv s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> invs s \<and> valid_etcbs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (croot' = None \<longrightarrow> invs s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a aa. aa \<turnstile> a) \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) a) s \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> ((\<lambda>a. case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) a) \<circ> snd) a) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some a \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) a) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) \<and> (\<forall>a aa b. croot' = Some (a, aa, b) \<longrightarrow> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> is_cnode_or_valid_arch a \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> invs s \<and> emptyable (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp a s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some b \<Rightarrow> \<lambda>c. no_cap_to_obj_dr_emp (fst b) c \<and> no_cap_to_obj_dr_emp a c) s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> s \<turnstile> a \<and> Structures_A.is_cnode_cap a \<and> aa \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. b \<turnstile> fst a) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> is_valid_vtable_root (fst x)) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some y \<Rightarrow> fst a' \<noteq> idle_thread s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> \<lambda>b. fst (snd a) \<noteq> idle_thread b) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> (swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) (fst x)) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits))
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?P'2180\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>_ s. invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 4. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> ?P'2180 s)) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer')\<rbrakk> \<Longrightarrow> \<lbrace>?P'2180\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>_ s. invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>
 2. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> ?P'2180 s)) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2738\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>_ s. invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>
 2. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> (?P'2738 and K (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) s)) s proof (prove)
goal (11 subgoals):
 1. \<And>tcb v. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<forall>(getF, setF)\<in>ran tcb_cap_cases. getF ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) = getF tcb
 2. \<And>tcb v. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> tcb_arch_ref ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) = tcb_arch_ref tcb
 3. \<And>tcb v. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> tcb_state ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) = tcb_state tcb
 4. \<And>tcb v. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> tcb_bound_notification ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) = tcb_bound_notification tcb
 5. \<And>tcb v. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> tcb_iarch ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) = tcb_iarch tcb
 6. \<And>tcb v. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> tcb_ipc_buffer ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) = tcb_ipc_buffer tcb \<or> tcb_ipc_buffer ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) = 0
 7. \<And>tcb v'. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits; fault_ep' = Some v'\<rbrakk> \<Longrightarrow> tcb_fault_handler ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v' tcb) \<noteq> tcb_fault_handler tcb \<longrightarrow> length (tcb_fault_handler ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v' tcb)) = word_bits
 8. \<And>tcb v. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> tcb_fault ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) \<noteq> tcb_fault tcb \<longrightarrow> (case tcb_fault ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) of None \<Rightarrow> True | Some f \<Rightarrow> valid_fault f)
 9. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2740\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv s. valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrace>
 10. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
A total of 11 subgoals... proof (prove)
goal (3 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2740\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv s. valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s\<rbrace>
 2. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> ((\<lambda>s. invs s \<and> ?P'2740 s) and K (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) s)) s proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P2782 x\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv. no_cap_to_obj_dr_emp (fst x)\<rbrace>
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2781\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv s. (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s\<rbrace>
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 4. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> ((\<lambda>s. invs s \<and> valid_etcbs s \<and> (not_idle_thread obj_id' and not_idle_thread obj_id') s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case croot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ?P2782 x) s \<and> ?P'2781 s) and K (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) s)) s proof (prove)
goal (4 subgoals):
 1. \<And>x tcb v. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<forall>(getF, x)\<in>ran tcb_cap_cases. getF ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) = getF tcb
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2781\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv s. (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s\<rbrace>
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 4. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> ((\<lambda>s. invs s \<and> valid_etcbs s \<and> (not_idle_thread obj_id' and not_idle_thread obj_id') s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case croot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> ?P'2781 s) and K (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) s)) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2781\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv s. (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s\<rbrace>
 2. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> ((\<lambda>s. invs s \<and> valid_etcbs s \<and> (not_idle_thread obj_id' and not_idle_thread obj_id') s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case croot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> ?P'2781 s) and K (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) s)) s proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P2816 x\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv. no_cap_to_obj_dr_emp (fst x)\<rbrace>
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2815\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv s. (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s\<rbrace>
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 4. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> ((\<lambda>s. invs s \<and> valid_etcbs s \<and> (not_idle_thread obj_id' and not_idle_thread obj_id') s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case croot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ?P2816 x) s \<and> ?P'2815 s) and K (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) s)) s proof (prove)
goal (4 subgoals):
 1. \<And>x tcb v. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<forall>(getF, x)\<in>ran tcb_cap_cases. getF ((tcb_fault_handler_update \<circ> (\<lambda>x y. x)) v tcb) = getF tcb
 2. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2815\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv s. (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s\<rbrace>
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 4. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> ((\<lambda>s. invs s \<and> valid_etcbs s \<and> (not_idle_thread obj_id' and not_idle_thread obj_id') s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case croot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> ?P'2815 s) and K (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) s)) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2815\<rbrace> option_update_thread obj_id' (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) fault_ep' \<lbrace>\<lambda>rv s. (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s\<rbrace>
 2. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)) s
 3. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (not_idle_thread obj_id' and valid_etcbs and (\<lambda>s. True \<and> valid_etcbs s \<and> True \<and> ((\<lambda>s. invs s \<and> valid_etcbs s \<and> (not_idle_thread obj_id' and not_idle_thread obj_id') s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case croot' of None \<Rightarrow> True | Some a \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) a) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case croot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case vroot' of None \<Rightarrow> True | Some a \<Rightarrow> (is_valid_vtable_root \<circ> fst) a) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> ?P'2815 s) and K (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>t' = tcb_invocation.ThreadControl obj_id' a' fault_ep' mcp' prio' croot' vroot' ipc_buffer'; t = cdl_tcb_invocation.ThreadControl obj_id' (transform_cslot_ptr a') (map_option of_bl fault_ep') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot') (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) vroot') (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) s \<and> (case vroot' of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) \<and> (case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> case snd a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd a)) s \<and> (case fault_ep' of None \<Rightarrow> True | Some bl \<Rightarrow> length bl = word_bits)\<rbrakk> \<Longrightarrow> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case croot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> (case vroot' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap (fst x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> not_idle_thread (fst (snd x)) and not_idle_thread obj_id') s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x)) s \<and> (case vroot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> no_cap_to_obj_dr_emp (fst x)) s \<and> (case ipc_buffer' of None \<Rightarrow> True | Some y \<Rightarrow> (not_idle_thread (fst a') and not_idle_thread obj_id') s) \<and> (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> case snd x of None \<Rightarrow> \<lambda>_. True | Some xa \<Rightarrow> not_idle_thread (fst (snd xa)) and not_idle_thread obj_id') s