theory Tcb_R

lemma transferCaps_corres:
  assumes x: "newroot_rel e e'"
  assumes y: "newroot_rel f f'"
  assumes z: "(case g of None \<Rightarrow> g' = None
                       | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''')
                              \<and> newroot_rel g'' g''')"
  assumes sl: "{e, f, option_map undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot"
  shows
    "corres (dc \<oplus> (=))
    (einvs and simple_sched_action and tcb_at a and
     (\<lambda>s. {e, f, option_map undefined g} \<noteq> {None} \<longrightarrow> cte_at slot s) and
     case_option \<top> (valid_cap o fst) e and
     case_option \<top> (cte_at o snd) e and
     case_option \<top> (no_cap_to_obj_dr_emp o fst) e and
     K (case_option True (is_cnode_cap o fst) e) and
     case_option \<top> (valid_cap o fst) f and
     case_option \<top> (cte_at o snd) f and
     case_option \<top> (no_cap_to_obj_dr_emp o fst) f and
     K (case_option True (is_valid_vtable_root o fst) f)
      and case_option \<top> (case_option \<top> (cte_at o snd) o snd) g
      and case_option \<top> (case_option \<top> (no_cap_to_obj_dr_emp o fst) o snd) g
      and case_option \<top> (case_option \<top> (valid_cap o fst) o snd) g
      and K (case_option True ((\<lambda>v. is_aligned v msg_align_bits) o fst) g)
      and K (case_option True (\<lambda>v. case_option True ((swp valid_ipc_buffer_cap (fst v)
                                  and is_arch_cap and is_cnode_or_valid_arch) o fst) (snd v)) g)
      and (\<lambda>s. case_option True (\<lambda>(pr, auth). mcpriority_tcb_at (\<lambda>m. pr \<le> m) auth s) p_auth) \<comment> \<open>only set prio \<le> mcp\<close>
      and (\<lambda>s. case_option True (\<lambda>(mcp, auth). mcpriority_tcb_at (\<lambda>m. mcp \<le> m) auth s) mcp_auth) \<comment> \<open>only set mcp \<le> prev_mcp\<close>)
    (invs' and sch_act_simple and case_option \<top> (valid_cap' o fst) e' and
     (\<lambda>s. {e', f', option_map undefined g'} \<noteq> {None} \<longrightarrow> cte_at' (cte_map slot) s) and
     K (case_option True (isCNodeCap o fst) e') and
     case_option \<top> (valid_cap' o fst) f' and
     K (case_option True (isValidVTableRoot o fst) f') and
     K (case_option True ((\<lambda>v. is_aligned v msg_align_bits) o fst) g') and
     K (case_option True (case_option True (isArchObjectCap o fst) o snd) g') and
     case_option \<top> (case_option \<top> (valid_cap' o fst) o snd) g' and
     tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and
     (\<lambda>s. case_option True (\<lambda>(pr, auth). mcpriority_tcb_at' ((\<le>) pr) auth s) p_auth) and
     (\<lambda>s. case_option True (\<lambda>(m, auth). mcpriority_tcb_at' ((\<le>) m) auth s) mcp_auth))
    (invoke_tcb (tcb_invocation.ThreadControl a slot (option_map to_bl b') mcp_auth p_auth e f g))
    (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g'))" proof - have P: "\<And>t v. corres dc
               (tcb_at t)
               (tcb_at' t)
               (option_update_thread t (tcb_fault_handler_update o (%x _. x))
               (option_map to_bl v))
               (case v of None \<Rightarrow> return ()
                 | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (%_. x)) t)" apply (rule out_corres, simp_all add: exst_same_def) apply (case_tac v, simp_all add: out_rel_def) apply (safe, case_tac tcb', simp add: tcb_relation_def split: option.split) done have R: "\<And>t v. corres dc
               (tcb_at t)
               (tcb_at' t)
               (option_update_thread t (tcb_ipc_buffer_update o (%x _. x)) v)
               (case v of None \<Rightarrow> return ()
                 | Some x \<Rightarrow> threadSet (tcbIPCBuffer_update (%_. x)) t)" apply (rule out_corres, simp_all add: exst_same_def) apply (case_tac v, simp_all add: out_rel_def) apply (safe, case_tac tcb', simp add: tcb_relation_def) done have S: "\<And>t x. corres dc (einvs and tcb_at t) (invs' and tcb_at' t and valid_objs' and K (valid_option_prio p_auth))
                   (case_option (return ()) (\<lambda>(p, auth). set_priority t p) p_auth)
                   (case_option (return ()) (\<lambda>p'. setPriority t (fst p')) p_auth)" apply (case_tac p_auth; clarsimp simp: setPriority_corres) done have S': "\<And>t x. corres dc (tcb_at t) (tcb_at' t)
                    (case_option (return ()) (\<lambda>(mcp, auth). set_mcpriority t mcp) mcp_auth)
                    (case_option (return ()) (\<lambda>mcp'. setMCPriority t (fst mcp')) mcp_auth)" apply(case_tac mcp_auth; clarsimp simp: setMCPriority_corres) done have T: "\<And>x x' ref getfn target.
      \<lbrakk> newroot_rel x x'; getfn = return (cte_map (target, ref));
             x \<noteq> None \<longrightarrow> {e, f, option_map undefined g} \<noteq> {None} \<rbrakk> \<Longrightarrow>
      corres (dc \<oplus> dc)

             (einvs and simple_sched_action and cte_at (target, ref) and emptyable (target, ref) and
              (\<lambda>s. \<forall>(sl, c) \<in> (case x of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}).
                        cte_at sl s \<and> no_cap_to_obj_dr_emp c s \<and> valid_cap c s)
              and K (case x of None \<Rightarrow> True
                       | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c))
             (invs' and sch_act_simple and cte_at' (cte_map (target, ref)) and
              (\<lambda>s. \<forall>cp \<in> (case x' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}). s \<turnstile>' cp))
          (case x of None \<Rightarrow> returnOk ()
           | Some pr \<Rightarrow> case_prod (\<lambda>new_cap src_slot.
               doE cap_delete (target, ref);
                   liftE $ check_cap_at new_cap src_slot $
                           check_cap_at (cap.ThreadCap target) slot $
                           cap_insert new_cap src_slot (target, ref)
               odE) pr)
          (case x' of
              None \<Rightarrow> returnOk ()
              | Some pr \<Rightarrow> (\<lambda>(newCap, srcSlot).
                  do slot \<leftarrow> getfn;
                     doE uu \<leftarrow> cteDelete slot True;
                         liftE (checkCapAt newCap srcSlot
                               (checkCapAt (capability.ThreadCap target) sl'
                               (assertDerived srcSlot newCap (cteInsert newCap srcSlot slot))))
                     odE
                  od) pr)" apply (case_tac "x = None") apply (simp add: newroot_rel_def returnOk_def) apply (drule(1) mp, drule mp [OF sl]) apply (clarsimp simp add: newroot_rel_def returnOk_def split_def) apply (rule corres_gen_asm) apply (rule corres_guard_imp) apply (rule corres_split_norE[OF cteDelete_corres]) apply (simp del: dc_simp) apply (erule checkCapAt_cteInsert_corres) apply (fold validE_R_def) apply (wp cap_delete_deletes cap_delete_cte_at cap_delete_valid_cap
                    | strengthen use_no_cap_to_obj_asid_strg)+ apply (wp cteDelete_invs' cteDelete_deletes) apply (clarsimp dest!: is_cnode_or_valid_arch_cap_asid) apply clarsimp done have U2: "getThreadBufferSlot a = return (cte_map (a, tcb_cnode_index 4))" by (simp add: getThreadBufferSlot_def locateSlot_conv
                  cte_map_def tcb_cnode_index_def tcbIPCBufferSlot_def
                  cte_level_bits_def) have T2: "corres (dc \<oplus> dc)
     (einvs and simple_sched_action and tcb_at a and
         (\<lambda>s. \<forall>(sl, c) \<in> (case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union>
             (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)})).
                   cte_at sl s \<and> no_cap_to_obj_dr_emp c s \<and> valid_cap c s)
         and K (case g of None \<Rightarrow> True | Some (x, v) \<Rightarrow> (case v of
                   None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c
                                                 \<and> is_arch_cap c
                                                 \<and> valid_ipc_buffer_cap c x
                                                 \<and> is_aligned x msg_align_bits)))
     (invs' and sch_act_simple and tcb_at' a and
       (\<lambda>s. \<forall>cp \<in> (case g' of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> (case v of
                              None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c})). s \<turnstile>' cp) and
       K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits
       \<and> (case v of None \<Rightarrow> True | Some (ac, _) \<Rightarrow> isArchObjectCap ac)) )
     (case_option (returnOk ())
       (case_prod
         (\<lambda>ptr frame.
             doE cap_delete (a, tcb_cnode_index 4);
                 do y \<leftarrow> thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
                    y \<leftarrow> case_option (return ())
                          (case_prod
                          (\<lambda>new_cap src_slot.
                            check_cap_at new_cap src_slot $
                            check_cap_at (cap.ThreadCap a) slot $
                            cap_insert new_cap src_slot (a, tcb_cnode_index 4)))
                          frame;
                    cur \<leftarrow> gets cur_thread;
                    liftE $ when (cur = a) (reschedule_required)
                 od
             odE))
       g)
     (case_option (returnOk ())
        (\<lambda>(ptr, frame).
            do bufferSlot \<leftarrow> getThreadBufferSlot a;
            doE y \<leftarrow> cteDelete bufferSlot True;
            do y \<leftarrow> threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
               y \<leftarrow> (case_option (return ())
                      (case_prod
                        (\<lambda>newCap srcSlot.
                            checkCapAt newCap srcSlot $
                            checkCapAt
                             (capability.ThreadCap a)
                             sl' $
                            assertDerived srcSlot newCap $
                            cteInsert newCap srcSlot bufferSlot))
                      frame);
               cur \<leftarrow> getCurThread;
               liftE $ when (cur = a) rescheduleRequired
            od odE od)
        g')" (is "corres _ ?T2_pre ?T2_pre' _ _") using z sl apply - apply (rule corres_guard_imp[where P=P and P'=P'
                                  and Q="P and cte_at (a, tcb_cnode_index 4)"
                                  and Q'="P' and cte_at' (cte_map (a, cap))" for P P' a cap]) apply (cases g) apply (simp, simp add: returnOk_def) apply (clarsimp simp: liftME_def[symmetric] U2 liftE_bindE) apply (case_tac b, simp_all add: newroot_rel_def) apply (rule corres_guard_imp) apply (rule corres_split_norE) apply (rule cteDelete_corres) apply (rule_tac F="is_aligned aa msg_align_bits" in corres_gen_asm2) apply (rule corres_split_nor) apply (rule threadset_corres,
                      (simp add: tcb_relation_def), (simp add: exst_same_def)+)[1] apply (rule corres_split[OF getCurThread_corres], clarsimp) apply (rule corres_when[OF refl rescheduleRequired_corres]) apply (wpsimp wp: gct_wp)+ apply (wp hoare_drop_imp) apply (rule threadcontrol_corres_helper1[unfolded pred_conj_def]) apply simp apply (wp hoare_drop_imp) apply (wp threadcontrol_corres_helper2 | wpc | simp)+ apply (wpsimp wp: cteDelete_invs' hoare_vcg_conj_lift) apply (fastforce simp: emptyable_def) apply fastforce apply clarsimp apply (rule corres_guard_imp) apply (rule corres_split_norE[OF cteDelete_corres]) apply (rule_tac F="is_aligned aa msg_align_bits" in corres_gen_asm) apply (rule_tac F="isArchObjectCap ac" in corres_gen_asm2) apply (rule corres_split_nor) apply (rule threadset_corres,
                    simp add: tcb_relation_def, (simp add: exst_same_def)+) apply (rule corres_split_nor) apply (erule checkCapAt_cteInsert_corres) apply (rule corres_split[OF getCurThread_corres], clarsimp) apply (rule corres_when[OF refl rescheduleRequired_corres]) apply (wp gct_wp)+ apply (wp hoare_drop_imp threadcontrol_corres_helper3)[1] apply (wp hoare_drop_imp threadcontrol_corres_helper4)[1] apply (wp thread_set_tcb_ipc_buffer_cap_cleared_invs
                     thread_set_cte_wp_at_trivial thread_set_not_state_valid_sched
                  | simp add: ran_tcb_cap_cases)+ apply (wp threadSet_invs_trivial
                    threadSet_cte_wp_at' | simp)+ apply (wp cap_delete_deletes cap_delete_cte_at
                   cap_delete_valid_cap cteDelete_deletes
                   cteDelete_invs'
                | strengthen use_no_cap_to_obj_asid_strg
                | clarsimp simp: inQ_def inQ_tc_corres_helper)+ apply (clarsimp simp: cte_wp_at_caps_of_state
                      dest!: is_cnode_or_valid_arch_cap_asid) apply (clarsimp simp: emptyable_def) apply (clarsimp simp: inQ_def) apply (clarsimp simp: obj_at_def is_tcb) apply (rule cte_wp_at_tcbI, simp, fastforce, simp) apply (clarsimp simp: cte_map_def tcb_cnode_index_def obj_at'_def
                          projectKOs objBits_simps) apply (erule(2) cte_wp_at_tcbI', fastforce simp: objBits_defs cte_level_bits_def, simp) done have U: "getThreadCSpaceRoot a = return (cte_map (a, tcb_cnode_index 0))" apply (clarsimp simp add: getThreadCSpaceRoot) apply (simp add: cte_map_def tcb_cnode_index_def
                     cte_level_bits_def word_bits_def) done have V: "getThreadVSpaceRoot a = return (cte_map (a, tcb_cnode_index 1))" apply (clarsimp simp add: getThreadVSpaceRoot) apply (simp add: cte_map_def tcb_cnode_index_def to_bl_1 objBits_defs
                     cte_level_bits_def word_bits_def) done have X: "\<And>x P Q R M. (\<And>y. x = Some y \<Longrightarrow> \<lbrace>P y\<rbrace> M y \<lbrace>Q\<rbrace>,\<lbrace>R\<rbrace>)
               \<Longrightarrow> \<lbrace>case_option (Q ()) P x\<rbrace> case_option (returnOk ()) M x \<lbrace>Q\<rbrace>,\<lbrace>R\<rbrace>" by (case_tac x, simp_all, wp) have Y: "\<And>x P Q M. (\<And>y. x = Some y \<Longrightarrow> \<lbrace>P y\<rbrace> M y \<lbrace>Q\<rbrace>,-)
               \<Longrightarrow> \<lbrace>case_option (Q ()) P x\<rbrace> case_option (returnOk ()) M x \<lbrace>Q\<rbrace>,-" by (case_tac x, simp_all, wp) have Z: "\<And>P f R Q x. \<lbrace>P\<rbrace> f \<lbrace>\<lambda>rv. Q and R\<rbrace> \<Longrightarrow> \<lbrace>P\<rbrace> f \<lbrace>\<lambda>rv. case_option Q (\<lambda>y. R) x\<rbrace>" apply (rule hoare_post_imp) defer apply assumption apply (case_tac x, simp_all) done have A: "\<And>x P Q M. (\<And>y. x = Some y \<Longrightarrow> \<lbrace>P y\<rbrace> M y \<lbrace>Q\<rbrace>)
               \<Longrightarrow> \<lbrace>case_option (Q ()) P x\<rbrace> case_option (return ()) M x \<lbrace>Q\<rbrace>" by (case_tac x, simp_all, wp) have B: "\<And>t v. \<lbrace>invs' and tcb_at' t\<rbrace> threadSet (tcbFaultHandler_update v) t \<lbrace>\<lambda>rv. invs'\<rbrace>" by (wp threadSet_invs_trivial | clarsimp simp: inQ_def)+ note stuff = Z B out_invs_trivial hoare_case_option_wp
    hoare_vcg_const_Ball_lift hoare_vcg_const_Ball_lift_R
    cap_delete_deletes cap_delete_valid_cap out_valid_objs
    cap_insert_objs
    cteDelete_deletes cteDelete_sch_act_simple
    out_valid_cap out_cte_at out_tcb_valid out_emptyable
    CSpaceInv_AI.cap_insert_valid_cap cap_insert_cte_at cap_delete_cte_at
    cap_delete_tcb cteDelete_invs' checkCap_inv [where P="valid_cap' c0" for c0]
    check_cap_inv[where P="tcb_at p0" for p0] checkCap_inv [where P="tcb_at' p0" for p0]
    check_cap_inv[where P="cte_at p0" for p0] checkCap_inv [where P="cte_at' p0" for p0]
    check_cap_inv[where P="valid_cap c" for c] checkCap_inv [where P="valid_cap' c" for c]
    check_cap_inv[where P="tcb_cap_valid c p1" for c p1]
    check_cap_inv[where P=valid_sched]
    check_cap_inv[where P=simple_sched_action]
    checkCap_inv [where P=sch_act_simple]
    out_no_cap_to_trivial [OF ball_tcb_cap_casesI]
    checked_insert_no_cap_to note if_cong [cong] option.case_cong [cong] show ?thesis apply (simp add: invokeTCB_def liftE_bindE) apply (simp only: eq_commute[where a= "a"]) apply (rule corres_guard_imp) apply (rule corres_split_nor[OF P]) apply (rule corres_split_nor[OF S', simplified]) apply (rule corres_split_norE[OF T [OF x U], simplified]) apply (rule corres_split_norE[OF T [OF y V], simplified]) apply (rule corres_split_norE) apply (rule T2[simplified]) apply (rule corres_split_nor[OF S, simplified]) apply (rule corres_returnOkTT, simp) apply wp apply wp apply (wpsimp wp: hoare_vcg_const_imp_lift_R hoare_vcg_const_imp_lift
                                 hoare_vcg_all_lift_R hoare_vcg_all_lift as_user_invs cap_delete_deletes
                                 thread_set_ipc_tcb_cap_valid thread_set_tcb_ipc_buffer_cap_cleared_invs
                                 thread_set_cte_wp_at_trivial thread_set_valid_cap cap_delete_valid_cap
                                 reschedule_preserves_valid_sched thread_set_not_state_valid_sched
                                 check_cap_inv[where P=valid_sched] (* from stuff *)
                                 check_cap_inv[where P="tcb_at p0" for p0]
                           simp: ran_tcb_cap_cases) apply (strengthen use_no_cap_to_obj_asid_strg) apply (wpsimp wp: cap_delete_cte_at cap_delete_valid_cap) apply (wpsimp wp: hoare_drop_imps) apply ((wpsimp wp: hoare_vcg_const_imp_lift hoare_vcg_imp_lift' hoare_vcg_all_lift
                                       threadSet_cte_wp_at' threadSet_invs_trivialT2 cteDelete_invs'
                                 simp: tcb_cte_cases_def), (fastforce+)[6]) apply wpsimp apply (wpsimp wp: hoare_vcg_const_imp_lift hoare_drop_imps hoare_vcg_all_lift
                                    threadSet_invs_trivialT2 threadSet_cte_wp_at'
                              simp: tcb_cte_cases_def, (fastforce+)[6]) apply wpsimp apply (wpsimp wp: hoare_vcg_const_imp_lift hoare_drop_imps hoare_vcg_all_lift
                                    rescheduleRequired_invs' threadSet_cte_wp_at'
                              simp: tcb_cte_cases_def) apply (wpsimp wp: hoare_vcg_const_imp_lift hoare_drop_imps hoare_vcg_all_lift
                                   rescheduleRequired_invs' threadSet_invs_trivialT2 threadSet_cte_wp_at'
                             simp: tcb_cte_cases_def, (fastforce+)[6]) apply wpsimp apply (wpsimp wp: hoare_vcg_const_imp_lift hoare_drop_imps hoare_vcg_all_lift
                                   rescheduleRequired_invs' threadSet_invs_trivialT2 threadSet_cte_wp_at'
                             simp: tcb_cte_cases_def, (fastforce+)[6]) apply wpsimp apply (wpsimp wp: hoare_vcg_const_imp_lift hoare_drop_imps hoare_vcg_all_lift
                                   rescheduleRequired_invs' threadSet_cap_to' threadSet_invs_trivialT2
                                   threadSet_cte_wp_at' hoare_drop_imps
                               simp: tcb_cte_cases_def) apply (clarsimp) apply ((wpsimp wp: stuff hoare_vcg_all_lift_R hoare_vcg_all_lift
                                   hoare_vcg_const_imp_lift_R hoare_vcg_const_imp_lift
                                   threadSet_valid_objs' thread_set_not_state_valid_sched
                                   thread_set_tcb_ipc_buffer_cap_cleared_invs thread_set_cte_wp_at_trivial
                                   thread_set_no_cap_to_trivial getThreadBufferSlot_dom_tcb_cte_cases
                                   assertDerived_wp_weak threadSet_cap_to' out_pred_tcb_at_preserved
                                   checkCap_wp assertDerived_wp_weak cap_insert_objs'
                        | simp add: ran_tcb_cap_cases split_def U V
                                  emptyable_def
                        | strengthen tcb_cap_always_valid_strg
                                   tcb_at_invs
                                   use_no_cap_to_obj_asid_strg
                        | (erule exE, clarsimp simp: word_bits_def))+) apply (strengthen valid_tcb_ipc_buffer_update) apply (strengthen invs_valid_objs')+ apply (wpsimp wp: cteDelete_invs' hoare_vcg_imp_lift' hoare_vcg_all_lift) apply wpsimp apply wpsimp apply (clarsimp cong: imp_cong conj_cong simp: emptyable_def) apply (rule_tac Q'="\<lambda>_. ?T2_pre" in hoare_post_imp_R[simplified validE_R_def, rotated]) 
              (* beginning to deal with is_nondevice_page_cap *)
               apply (clarsimp simp: emptyable_def is_nondevice_page_cap_simps is_cap_simps
                                    is_cnode_or_valid_arch_def obj_ref_none_no_asid cap_asid_def
                              cong: conj_cong imp_cong
                             split: option.split_asm) 
              (* newly added proof scripts for dealing with is_nondevice_page_cap *)
               apply (simp add: case_bool_If valid_ipc_buffer_cap_def is_nondevice_page_cap_arch_def
                        split: arch_cap.splits if_splits) 
             (* is_nondevice_page_cap discharged *)
              apply ((wp stuff checkCap_wp assertDerived_wp_weak cap_insert_objs'
                     | simp add: ran_tcb_cap_cases split_def U V emptyable_def
                     | wpc | strengthen tcb_cap_always_valid_strg use_no_cap_to_obj_asid_strg)+)[1] apply (clarsimp cong: imp_cong conj_cong) apply (rule_tac Q'="\<lambda>_. ?T2_pre' and (\<lambda>s. valid_option_prio p_auth)"
                         in hoare_post_imp_R[simplified validE_R_def, rotated]) apply (case_tac g'; clarsimp simp: isCap_simps ; clarsimp elim: invs_valid_objs' cong:imp_cong) apply (wp add: stuff hoare_vcg_all_lift_R hoare_vcg_all_lift
                                 hoare_vcg_const_imp_lift_R hoare_vcg_const_imp_lift setMCPriority_invs'
                                 threadSet_valid_objs' thread_set_not_state_valid_sched setP_invs'
                                 typ_at_lifts [OF setPriority_typ_at']
                                 typ_at_lifts [OF setMCPriority_typ_at']
                                 threadSet_cap_to' out_pred_tcb_at_preserved assertDerived_wp
                      del: cteInsert_invs
                   | simp add: ran_tcb_cap_cases split_def U V
                               emptyable_def
                   | wpc | strengthen tcb_cap_always_valid_strg
                                      use_no_cap_to_obj_asid_strg
                   | wp (once) add: sch_act_simple_lift hoare_drop_imps del: cteInsert_invs
                   | (erule exE, clarsimp simp: word_bits_def))+ 
     (* the last two subgoals *)
      apply (clarsimp simp: tcb_at_cte_at_0 tcb_at_cte_at_1[simplified] tcb_at_st_tcb_at[symmetric]
                           tcb_cap_valid_def is_cnode_or_valid_arch_def invs_valid_objs emptyable_def
                           obj_ref_none_no_asid no_cap_to_obj_with_diff_ref_Null is_valid_vtable_root_def
                           is_cap_simps cap_asid_def vs_cap_ref_def arch_cap_fun_lift_def
                     cong: conj_cong imp_cong
                    split: option.split_asm) by (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def objBits_defs
                       cte_map_tcb_0 cte_map_tcb_1[simplified] tcb_at_cte_at' cte_at_tcb_at_16'
                       isCap_simps domIff valid_tcb'_def tcb_cte_cases_def arch_cap_fun_lift_def
                split: option.split_asm
                dest!: isValidVTableRootD) qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (state)
goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. \<And>t v. corres dc (tcb_at t) (tcb_at' t) (option_update_thread t (tcb_fault_handler_update \<circ> (\<lambda>x _. x)) (map_option to_bl v)) (case v of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>_. x)) t) proof (prove)
goal (1 subgoal):
 1. \<And>v. out_rel (tcb_fault_handler_update \<circ> (\<lambda>x _. x)) (\<lambda>x. tcbFaultHandler_update (\<lambda>_. x)) (map_option to_bl v) v proof (prove)
goal (1 subgoal):
 1. \<And>v a. v = Some a \<Longrightarrow> \<forall>tcb tcb'. tcb_relation tcb tcb' \<longrightarrow> tcb_relation (tcb\<lparr>tcb_fault_handler := to_bl a\<rparr>) (tcbFaultHandler_update (\<lambda>_. a) tcb') proof (prove)
goal:
No subgoals! proof (state)
this:
corres dc (tcb_at ?t) (tcb_at' ?t) (option_update_thread ?t (tcb_fault_handler_update \<circ> (\<lambda>x _. x)) (map_option to_bl ?v)) (case ?v of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>_. x)) ?t)

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. \<And>t v. corres dc (tcb_at t) (tcb_at' t) (option_update_thread t (tcb_ipc_buffer_update \<circ> (\<lambda>x _. x)) v) (case v of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbIPCBuffer_update (\<lambda>_. x)) t) proof (prove)
goal (1 subgoal):
 1. \<And>v. out_rel (tcb_ipc_buffer_update \<circ> (\<lambda>x _. x)) (\<lambda>x. tcbIPCBuffer_update (\<lambda>_. x)) v v proof (prove)
goal (1 subgoal):
 1. \<And>v a. v = Some a \<Longrightarrow> \<forall>tcb tcb'. tcb_relation tcb tcb' \<longrightarrow> tcb_relation (tcb\<lparr>tcb_ipc_buffer := a\<rparr>) (tcbIPCBuffer_update (\<lambda>_. a) tcb') proof (prove)
goal:
No subgoals! proof (state)
this:
corres dc (tcb_at ?t) (tcb_at' ?t) (option_update_thread ?t (tcb_ipc_buffer_update \<circ> (\<lambda>x _. x)) ?v) (case ?v of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbIPCBuffer_update (\<lambda>_. x)) ?t)

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. \<And>t x. corres dc (einvs and tcb_at t) (invs' and tcb_at' t and valid_objs' and K (valid_option_prio p_auth)) (case p_auth of None \<Rightarrow> return () | Some (p, auth) \<Rightarrow> set_priority t p) (case p_auth of None \<Rightarrow> return () | Some p' \<Rightarrow> setPriority t (fst p')) proof (prove)
goal:
No subgoals! proof (state)
this:
corres dc (einvs and tcb_at ?t) (invs' and tcb_at' ?t and valid_objs' and K (valid_option_prio p_auth)) (case p_auth of None \<Rightarrow> return () | Some (p, auth) \<Rightarrow> set_priority ?t p) (case p_auth of None \<Rightarrow> return () | Some p' \<Rightarrow> setPriority ?t (fst p'))

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. \<And>t x. corres dc (tcb_at t) (tcb_at' t) (case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority t mcp) (case mcp_auth of None \<Rightarrow> return () | Some mcp' \<Rightarrow> setMCPriority t (fst mcp')) proof (prove)
goal:
No subgoals! proof (state)
this:
corres dc (tcb_at ?t1) (tcb_at' ?t1) (case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority ?t1 mcp) (case mcp_auth of None \<Rightarrow> return () | Some mcp' \<Rightarrow> setMCPriority ?t1 (fst mcp'))

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. \<And>x x' ref getfn target. \<lbrakk>newroot_rel x x'; getfn = return (cte_map (target, ref)); x \<noteq> None \<longrightarrow> {e, f, map_option undefined g} \<noteq> {None}\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. \<forall>(sl, c)\<in>case x of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case x of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and (\<lambda>s. \<forall>cp\<in>case x' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s)) (case x of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (target, ref);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap target) slot $ cap_insert new_cap src_slot (target, ref)
odE) (case x' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do slot <- getfn;
doE uu <- cteDelete slot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap target) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot slot))))
odE
od) proof (prove)
goal (2 subgoals):
 1. \<And>x x' ref getfn target. \<lbrakk>newroot_rel x x'; getfn = return (cte_map (target, ref)); x \<noteq> None \<longrightarrow> {e, f, map_option undefined g} \<noteq> {None}; x = None\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. \<forall>(sl, c)\<in>case x of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case x of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and (\<lambda>s. \<forall>cp\<in>case x' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s)) (case x of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (target, ref);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap target) slot $ cap_insert new_cap src_slot (target, ref)
odE) (case x' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do slot <- getfn;
doE uu <- cteDelete slot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap target) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot slot))))
odE
od)
 2. \<And>x x' ref getfn target. \<lbrakk>newroot_rel x x'; getfn = return (cte_map (target, ref)); x \<noteq> None \<longrightarrow> {e, f, map_option undefined g} \<noteq> {None}; x \<noteq> None\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. \<forall>(sl, c)\<in>case x of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case x of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and (\<lambda>s. \<forall>cp\<in>case x' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s)) (case x of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (target, ref);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap target) slot $ cap_insert new_cap src_slot (target, ref)
odE) (case x' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do slot <- getfn;
doE uu <- cteDelete slot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap target) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot slot))))
odE
od) proof (prove)
goal (1 subgoal):
 1. \<And>x x' ref getfn target. \<lbrakk>newroot_rel x x'; getfn = return (cte_map (target, ref)); x \<noteq> None \<longrightarrow> {e, f, map_option undefined g} \<noteq> {None}; x \<noteq> None\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. \<forall>(sl, c)\<in>case x of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case x of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and (\<lambda>s. \<forall>cp\<in>case x' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s)) (case x of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (target, ref);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap target) slot $ cap_insert new_cap src_slot (target, ref)
odE) (case x' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do slot <- getfn;
doE uu <- cteDelete slot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap target) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot slot))))
odE
od) proof (prove)
goal (1 subgoal):
 1. \<And>x x' ref getfn target. \<lbrakk>newroot_rel x x'; getfn = return (cte_map (target, ref)); x \<noteq> None; sl' = cte_map slot\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. \<forall>(sl, c)\<in>case x of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case x of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and (\<lambda>s. \<forall>cp\<in>case x' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s)) (case x of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (target, ref);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap target) slot $ cap_insert new_cap src_slot (target, ref)
odE) (case x' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do slot <- getfn;
doE uu <- cteDelete slot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap target) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot slot))))
odE
od) proof (prove)
goal (1 subgoal):
 1. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a) and (\<lambda>y. is_cnode_or_valid_arch a)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and valid_cap' ab) (doE y <- cap_delete (target, ref);
liftE (check_cap_at a (aa, b) (check_cap_at (cap.ThreadCap target) slot (cap_insert a (aa, b) (target, ref))))
odE) (doE uu <- cteDelete (cte_map (target, ref)) True;
liftE (checkCapAt ab (cte_map (aa, b)) (checkCapAt (capability.ThreadCap target) (cte_map slot) (assertDerived (cte_map (aa, b)) ab (cteInsert ab (cte_map (aa, b)) (cte_map (target, ref))))))
odE) proof (prove)
goal (1 subgoal):
 1. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and valid_cap' ab) (doE y <- cap_delete (target, ref);
liftE (check_cap_at a (aa, b) (check_cap_at (cap.ThreadCap target) slot (cap_insert a (aa, b) (target, ref))))
odE) (doE uu <- cteDelete (cte_map (target, ref)) True;
liftE (checkCapAt ab (cte_map (aa, b)) (checkCapAt (capability.ThreadCap target) (cte_map slot) (assertDerived (cte_map (aa, b)) ab (cteInsert ab (cte_map (aa, b)) (cte_map (target, ref))))))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q25 ref target a aa b ab) (?Q'25 ref target a aa b ab) (doE y <- cap_delete (target, ref);
liftE (check_cap_at a (aa, b) (check_cap_at (cap.ThreadCap target) slot (cap_insert a (aa, b) (target, ref))))
odE) (doE uu <- cteDelete (cte_map (target, ref)) True;
liftE (checkCapAt ab (cte_map (aa, b)) (checkCapAt (capability.ThreadCap target) (cte_map slot) (assertDerived (cte_map (aa, b)) ab (cteInsert ab (cte_map (aa, b)) (cte_map (target, ref))))))
odE)
 2. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a)) s\<rbrakk> \<Longrightarrow> ?Q25 ref target a aa b ab s
 3. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and valid_cap' ab) s\<rbrakk> \<Longrightarrow> ?Q'25 ref target a aa b ab s proof (prove)
goal (5 subgoals):
 1. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R29 ref target a aa b ab) (?R'29 ref target a aa b ab) (liftE (check_cap_at a (aa, b) (check_cap_at (cap.ThreadCap target) slot (cap_insert a (aa, b) (target, ref))))) (liftE (checkCapAt ab (cte_map (aa, b)) (checkCapAt (capability.ThreadCap target) (cte_map slot) (assertDerived (cte_map (aa, b)) ab (cteInsert ab (cte_map (aa, b)) (cte_map (target, ref)))))))
 2. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> \<lbrace>?Q29 ref target a aa b ab\<rbrace> cap_delete (target, ref) \<lbrace>\<lambda>x. ?R29 ref target a aa b ab\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'29 ref target a aa b ab\<rbrace> cteDelete (cte_map (target, ref)) True \<lbrace>\<lambda>x. ?R'29 ref target a aa b ab\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and ?Q29 ref target a aa b ab) s
 5. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and valid_cap' ab) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and ?Q'29 ref target a aa b ab) s proof (prove)
goal (5 subgoals):
 1. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> corres dc (?R29 ref target a aa b ab) (?R'29 ref target a aa b ab) (check_cap_at a (aa, b) (check_cap_at (cap.ThreadCap target) slot (cap_insert a (aa, b) (target, ref)))) (checkCapAt ab (cte_map (aa, b)) (checkCapAt (capability.ThreadCap target) (cte_map slot) (assertDerived (cte_map (aa, b)) ab (cteInsert ab (cte_map (aa, b)) (cte_map (target, ref))))))
 2. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> \<lbrace>?Q29 ref target a aa b ab\<rbrace> cap_delete (target, ref) \<lbrace>\<lambda>x. ?R29 ref target a aa b ab\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'29 ref target a aa b ab\<rbrace> cteDelete (cte_map (target, ref)) True \<lbrace>\<lambda>x. ?R'29 ref target a aa b ab\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and ?Q29 ref target a aa b ab) s
 5. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and valid_cap' ab) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and ?Q'29 ref target a aa b ab) s proof (prove)
goal (4 subgoals):
 1. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> \<lbrace>?Q29 ref target a aa b ab\<rbrace> cap_delete (target, ref) \<lbrace>\<lambda>x. einvs and cte_wp_at (\<lambda>c. c = cap.NullCap) (target, ref) and cte_wp_at (\<lambda>_. True) slot and K (is_cnode_or_valid_arch a \<and> (is_pt_cap a \<or> is_pd_cap a \<longrightarrow> cap_asid a \<noteq> None)) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs a \<longrightarrow> table_cap_ref c = table_cap_ref a \<and> pt_pd_asid c = pt_pd_asid a) (aa, b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'29 ref target a aa b ab\<rbrace> cteDelete (cte_map (target, ref)) True \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (target, ref)) and valid_cap' ab\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and ?Q29 ref target a aa b ab) s
 4. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and valid_cap' ab) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and ?Q'29 ref target a aa b ab) s proof (prove)
goal (4 subgoals):
 1. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> \<lbrace>?Q29 ref target a aa b ab\<rbrace> cap_delete (target, ref) \<lbrace>\<lambda>x. einvs and cte_wp_at (\<lambda>c. c = cap.NullCap) (target, ref) and cte_wp_at (\<lambda>_. True) slot and K (is_cnode_or_valid_arch a \<and> (is_pt_cap a \<or> is_pd_cap a \<longrightarrow> cap_asid a \<noteq> None)) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs a \<longrightarrow> table_cap_ref c = table_cap_ref a \<and> pt_pd_asid c = pt_pd_asid a) (aa, b)\<rbrace>, -
 2. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'29 ref target a aa b ab\<rbrace> cteDelete (cte_map (target, ref)) True \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (target, ref)) and valid_cap' ab\<rbrace>, -
 3. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and ?Q29 ref target a aa b ab) s
 4. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and valid_cap' ab) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and ?Q'29 ref target a aa b ab) s proof (prove)
goal (3 subgoals):
 1. \<And>ref target a aa b ab. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'29 ref target a aa b ab\<rbrace> cteDelete (cte_map (target, ref)) True \<lbrace>\<lambda>x s. invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (target, ref)) s \<and> valid_cap' ab s\<rbrace>, -
 2. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. (invs and emptyable (target, ref)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> True \<and> cte_wp_at (\<lambda>_. True) slot s \<and> K (is_cnode_or_valid_arch a \<and> (is_pt_cap a \<or> is_pd_cap a \<longrightarrow> cap_asid a \<noteq> None)) s \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> (invs and emptyable (target, ref)) s)) s
 3. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and valid_cap' ab) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and ?Q'29 ref target a aa b ab) s proof (prove)
goal (2 subgoals):
 1. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (target, ref) and emptyable (target, ref) and (\<lambda>s. (invs and emptyable (target, ref)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> True \<and> cte_wp_at (\<lambda>_. True) slot s \<and> K (is_cnode_or_valid_arch a \<and> (is_pt_cap a \<or> is_pd_cap a \<longrightarrow> cap_asid a \<noteq> None)) s \<and> cte_wp_at (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s \<and> s \<turnstile> a \<and> (invs and emptyable (target, ref)) s)) s
 2. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and valid_cap' ab) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and (\<lambda>s. (invs' and sch_act_simple and K True) s \<and> True \<and> valid_cap' ab s)) s proof (prove)
goal (1 subgoal):
 1. \<And>ref target a aa b ab s. \<lbrakk>sl' = cte_map slot; cap_relation a ab; is_cnode_or_valid_arch a; (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and valid_cap' ab) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (target, ref)) and (\<lambda>s. (invs' and sch_act_simple and K True) s \<and> True \<and> valid_cap' ab s)) s proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>newroot_rel ?x2 ?x'2; ?getfn2 = return (cte_map (?target2, ?ref2)); ?x2 \<noteq> None \<longrightarrow> {e, f, map_option undefined g} \<noteq> {None}\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (?target2, ?ref2) and emptyable (?target2, ?ref2) and (\<lambda>s. \<forall>(sl, c)\<in>case ?x2 of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case ?x2 of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c)) (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (?target2, ?ref2)) and (\<lambda>s. \<forall>cp\<in>case ?x'2 of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s)) (case ?x2 of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (?target2, ?ref2);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap ?target2) slot $ cap_insert new_cap src_slot (?target2, ?ref2)
odE) (case ?x'2 of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do slot <- ?getfn2;
doE uu <- cteDelete slot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap ?target2) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot slot))))
odE
od)

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. getThreadBufferSlot a = return (cte_map (a, tcb_cnode_index 4)) proof (state)
this:
getThreadBufferSlot a = return (cte_map (a, tcb_cnode_index 4))

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac))) (case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap a) slot $ cap_insert new_cap src_slot (a, tcb_cnode_index 4);
cur <- gets cur_thread;
liftE $ when (cur = a) reschedule_required
od
odE) (case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot $ checkCapAt (capability.ThreadCap a) sl' $ assertDerived srcSlot newCap $ cteInsert newCap srcSlot bufferSlot;
cur <- getCurThread;
liftE $ when (cur = a) rescheduleRequired
od
odE
od) proof (prove)
using this:
case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''
{e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot

goal (1 subgoal):
 1. corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac))) (case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap a) slot $ cap_insert new_cap src_slot (a, tcb_cnode_index 4);
cur <- gets cur_thread;
liftE $ when (cur = a) reschedule_required
od
odE) (case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot $ checkCapAt (capability.ThreadCap a) sl' $ assertDerived srcSlot newCap $ cteInsert newCap srcSlot bufferSlot;
cur <- getCurThread;
liftE $ when (cur = a) rescheduleRequired
od
odE
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac))) (case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap a) slot $ cap_insert new_cap src_slot (a, tcb_cnode_index 4);
cur <- gets cur_thread;
liftE $ when (cur = a) reschedule_required
od
odE) (case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot $ checkCapAt (capability.ThreadCap a) sl' $ assertDerived srcSlot newCap $ cteInsert newCap srcSlot bufferSlot;
cur <- getCurThread;
liftE $ when (cur = a) rescheduleRequired
od
odE
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap a) slot $ cap_insert new_cap src_slot (a, tcb_cnode_index 4);
cur <- gets cur_thread;
liftE $ when (cur = a) reschedule_required
od
odE) (case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot $ checkCapAt (capability.ThreadCap a) sl' $ assertDerived srcSlot newCap $ cteInsert newCap srcSlot bufferSlot;
cur <- getCurThread;
liftE $ when (cur = a) rescheduleRequired
od
odE
od)
 2. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; g = None\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap a) slot $ cap_insert new_cap src_slot (a, tcb_cnode_index 4);
cur <- gets cur_thread;
liftE $ when (cur = a) reschedule_required
od
odE) (case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot $ checkCapAt (capability.ThreadCap a) sl' $ assertDerived srcSlot newCap $ cteInsert newCap srcSlot bufferSlot;
cur <- getCurThread;
liftE $ when (cur = a) rescheduleRequired
od
odE
od)
 2. \<And>aa. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; g = Some aa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap a) slot $ cap_insert new_cap src_slot (a, tcb_cnode_index 4);
cur <- gets cur_thread;
liftE $ when (cur = a) reschedule_required
od
odE) (case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot $ checkCapAt (capability.ThreadCap a) sl' $ assertDerived srcSlot newCap $ cteInsert newCap srcSlot bufferSlot;
cur <- getCurThread;
liftE $ when (cur = a) rescheduleRequired
od
odE
od)
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s
 4. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s proof (prove)
goal (3 subgoals):
 1. \<And>aa. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; g = Some aa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap a) slot $ cap_insert new_cap src_slot (a, tcb_cnode_index 4);
cur <- gets cur_thread;
liftE $ when (cur = a) reschedule_required
od
odE) (case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot $ checkCapAt (capability.ThreadCap a) sl' $ assertDerived srcSlot newCap $ cteInsert newCap srcSlot bufferSlot;
cur <- getCurThread;
liftE $ when (cur = a) rescheduleRequired
od
odE
od)
 2. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s proof (prove)
goal (3 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, b); newroot_rel b g'''; g' = Some (aa, g''')\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case b of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case b of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case b of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 2. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> newroot_rel g'' g'''; {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> sl' = cte_map slot; (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s proof (prove)
goal (4 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 2. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 4. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (6 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q27 aa b g''') (?Q'27 aa b g''') (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 2. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> ?Q27 aa b g''' s
 3. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> ?Q'27 aa b g''' s
 4. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 5. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 6. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (9 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P31 aa b g''') (?P'31 aa b g''') (cap_delete (a, tcb_cnode_index 4)) (cteDelete (cte_map (a, tcb_cnode_index 4)) True)
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R31 aa b g''') (?R'31 aa b g''') (do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. ?R31 aa b g'''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. ?R'31 aa b g'''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (?P31 aa b g''' and ?Q31 aa b g''') s
 6. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (?P'31 aa b g''' and ?Q'31 aa b g''') s
 7. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 9. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (8 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R31 aa b g''') (?R'31 aa b g''') (do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. ?R31 aa b g'''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. ?R'31 aa b g'''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 5. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 6. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 7. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (8 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R31 aa b g''') (?P'37 aa b g''') (do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. ?R31 aa b g'''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. ?P'37 aa b g''' and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 5. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 6. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 7. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (11 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> corres dc (?P38 aa b g''') (?P'38 aa b g''') (thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a) (threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a)
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R38 aa b g''') (?R'38 aa b g''') (do cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 aa b g'''\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. ?R38 aa b g'''\<rbrace>
 4. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'38 aa b g'''\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. ?R'38 aa b g'''\<rbrace>
 5. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. ?P38 aa b g''' and ?Q38 aa b g'''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. ?P'38 aa b g''' and ?Q'38 aa b g''' and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 8. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 9. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 10. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R38 aa b g''') (?R'38 aa b g''') (do cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 aa b g'''\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. ?R38 aa b g'''\<rbrace>
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'38 aa b g'''\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. ?R'38 aa b g'''\<rbrace>
 4. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q38 aa b g'''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'38 aa b g''' and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 7. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 8. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 9. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 10. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (12 subgoals):
 1. \<And>aa rv'. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g' = Some (aa, None); is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> corres dc (?R58 aa None None rv') (?R'58 aa None None rv') (when (rv' = a) reschedule_required) (when (rv' = a) rescheduleRequired)
 2. \<And>a b g'''. \<lbrakk>sl' = cte_map slot; g = Some (a, None); g''' = None; g' = Some (a, None); b = None; is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 a b g'''\<rbrace> gets cur_thread \<lbrace>?R58 a b g'''\<rbrace>
 3. \<And>a b g'''. \<lbrakk>sl' = cte_map slot; g = Some (a, None); g''' = None; g' = Some (a, None); b = None; is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 a b g'''\<rbrace> getCurThread \<lbrace>?R'58 a b g'''\<rbrace>
 4. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 aa b g'''\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q58 aa b g'''\<rbrace>
 5. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'38 aa b g'''\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q'58 aa b g'''\<rbrace>
 6. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q38 aa b g'''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'38 aa b g''' and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 9. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 10. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 aa b g'''\<rbrace> gets cur_thread \<lbrace>\<lambda>b c. b = a \<longrightarrow> (weak_valid_sched_action and valid_etcbs) c\<rbrace>
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 aa b g'''\<rbrace> getCurThread \<lbrace>\<lambda>b c. b = a \<longrightarrow> (Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) c\<rbrace>
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 aa b g'''\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q58 aa b g'''\<rbrace>
 4. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'38 aa b g'''\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q'58 aa b g'''\<rbrace>
 5. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q38 aa b g'''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'38 aa b g''' and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 8. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 9. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 10. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>aa. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g' = Some (aa, None); is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'77 aa (ds_id None) (ds_id None)\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>rv s. cur_thread s = a \<longrightarrow> weak_valid_sched_action s \<and> valid_etcbs s\<rbrace>
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'38 aa b g'''\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. ksCurThread s = a \<longrightarrow> (Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s)\<rbrace>
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and (\<lambda>s. True \<and> ?P'77 aa b g''' s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'38 aa b g''' and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 6. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 7. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 9. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (9 subgoals):
 1. \<And>aa. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g' = Some (aa, None); is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'77 aa (ds_id None) (ds_id None)\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>rv s. weak_valid_sched_action s \<and> valid_etcbs s\<rbrace>
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'38 aa b g'''\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. ksCurThread s = a \<longrightarrow> (Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s)\<rbrace>
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and (\<lambda>s. True \<and> ?P'77 aa b g''' s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'38 aa b g''' and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 6. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 7. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 9. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (8 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'38 aa b g'''\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. ksCurThread s = a \<longrightarrow> (Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s)\<rbrace>
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and (\<lambda>s. True \<and> ((invs s \<and> valid_list s) \<and> valid_sched s) \<and> simple_sched_action s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'38 aa b g''' and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 5. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 6. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 7. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (8 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'38 aa None None\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x s. ksCurThread s = a \<longrightarrow> Invariants_H.valid_queues s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and (\<lambda>s. True \<and> ((invs s \<and> valid_list s) \<and> valid_sched s) \<and> simple_sched_action s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'38 aa b g''' and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 5. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 6. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 7. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (8 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'38 aa (ds_id None) (ds_id None)\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>rv s. Invariants_H.valid_queues s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>
 2. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 aa b g'''\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and (\<lambda>s. True \<and> ((invs s \<and> valid_list s) \<and> valid_sched s) \<and> simple_sched_action s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 aa b g'''\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'38 aa b g''' and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q31 aa b g''') s
 5. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'31 aa b g''') s
 6. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 7. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (6 subgoals):
 1. \<And>aa b g'''. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None\<rbrakk> \<Longrightarrow> \<lbrace>?P'119 aa None None\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>rv s. invs' s \<and> tcb_at' a s \<and> is_aligned aa msg_align_bits\<rbrace>, -
 2. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and (\<lambda>s. True \<and> tcb_at a s \<and> True \<and> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s)) s
 3. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and (\<lambda>s. True \<and> tcb_at' a s \<and> ?P'119 aa b g''' s)) s
 4. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 5. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 6. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (5 subgoals):
 1. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and (\<lambda>s. True \<and> tcb_at a s \<and> True \<and> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s)) s
 2. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and (\<lambda>s. True \<and> tcb_at' a s \<and> (invs' and sch_act_simple and K True) s \<and> tcb_at' a s \<and> is_aligned aa msg_align_bits)) s
 3. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 4. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?aa7, tcb_cnode_index 4) s
 5. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (?aa7, ?cap7)) s proof (prove)
goal (4 subgoals):
 1. \<And>aa b g''' s. \<lbrakk>sl' = cte_map slot; g = Some (aa, None); g''' = None; g' = Some (aa, None); b = None; (invs' and sch_act_simple and tcb_at' a and (\<lambda>y. is_aligned aa msg_align_bits) and cte_wp_at' (\<lambda>_. True) (cte_map (a, ?cap7))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and (\<lambda>s. True \<and> tcb_at' a s \<and> (invs' and sch_act_simple and K True) s \<and> tcb_at' a s \<and> is_aligned aa msg_align_bits)) s
 2. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (a, ?cap7))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 4. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, ?cap7)) s proof (prove)
goal (3 subgoals):
 1. \<And>aa b g''' aaa. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some aaa); \<exists>a b. g''' = Some (a, b) \<and> (case aaa of (cap, ptr) \<Rightarrow> \<lambda>(cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) (a, b); g' = Some (aa, g'''); b = Some aaa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> (\<forall>x\<in>case aaa of (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c)) and (\<lambda>y. case aaa of (c, sl) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g''' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. is_aligned aa msg_align_bits \<and> (case g''' of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- case aaa of (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- case g''' of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived srcSlot newCap (cteInsert newCap srcSlot (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 2. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (3 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 2. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (5 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q191 aa aaa ab ba ac) (?Q'191 aa aaa ab ba ac) (doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (doE y <- cteDelete (cte_map (a, tcb_cnode_index 4)) True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od
odE)
 2. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> ?Q191 aa aaa ab ba ac s
 3. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> ?Q'191 aa aaa ab ba ac s
 4. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 5. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (7 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R195 aa aaa ab ba ac) (?R'195 aa aaa ab ba ac) (do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. ?R195 aa aaa ab ba ac\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. ?R'195 aa aaa ab ba ac\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 5. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 6. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 7. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (7 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P200 aa aaa ab ba ac) (?R'195 aa aaa ab ba ac) (do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. ?P200 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. ?R'195 aa aaa ab ba ac\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 5. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 6. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 7. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (7 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P200 aa aaa ab ba ac) (?P'201 aa aaa ab ba ac) (do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a;
y <- check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a;
y <- checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. ?P200 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. ?P'201 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 5. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 6. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 7. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (10 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> corres dc (?P202 aa aaa ab ba ac) (?P'202 aa aaa ab ba ac) (thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a) (threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a)
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R202 aa aaa ab ba ac) (?R'202 aa aaa ab ba ac) (do y <- check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do y <- checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q202 aa aaa ab ba ac\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. ?R202 aa aaa ab ba ac\<rbrace>
 4. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 aa aaa ab ba ac\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. ?R'202 aa aaa ab ba ac\<rbrace>
 5. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. ?P202 aa aaa ab ba ac and ?Q202 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. ?P'202 aa aaa ab ba ac and ?Q'202 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 8. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 9. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 10. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (9 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R202 aa aaa ab ba ac) (?R'202 aa aaa ab ba ac) (do y <- check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do y <- checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4)))));
cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q202 aa aaa ab ba ac\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. ?R202 aa aaa ab ba ac\<rbrace>
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 aa aaa ab ba ac\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. ?R'202 aa aaa ab ba ac\<rbrace>
 4. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q202 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'202 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 7. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 9. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (12 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> corres dc (?P220 aa aaa ab ba ac) (?P'220 aa aaa ab ba ac) (check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4)))) (checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4))))))
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R220 aa aaa ab ba ac) (?R'220 aa aaa ab ba ac) (do cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q220 aa aaa ab ba ac\<rbrace> check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4))) \<lbrace>\<lambda>x. ?R220 aa aaa ab ba ac\<rbrace>
 4. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'220 aa aaa ab ba ac\<rbrace> checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4))))) \<lbrace>\<lambda>x. ?R'220 aa aaa ab ba ac\<rbrace>
 5. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q202 aa aaa ab ba ac\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. ?P220 aa aaa ab ba ac and ?Q220 aa aaa ab ba ac\<rbrace>
 6. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 aa aaa ab ba ac\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. ?P'220 aa aaa ab ba ac and ?Q'220 aa aaa ab ba ac\<rbrace>
 7. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q202 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'202 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 10. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R220 aa aaa ab ba ac) (?R'220 aa aaa ab ba ac) (do cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od) (do cur <- getCurThread;
liftE (when (cur = a) rescheduleRequired)
od)
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q220 aa aaa ab ba ac\<rbrace> check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4))) \<lbrace>\<lambda>x. ?R220 aa aaa ab ba ac\<rbrace>
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'220 aa aaa ab ba ac\<rbrace> checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4))))) \<lbrace>\<lambda>x. ?R'220 aa aaa ab ba ac\<rbrace>
 4. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q202 aa aaa ab ba ac\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. einvs and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 4) and cte_wp_at (\<lambda>_. True) slot and K (is_cnode_or_valid_arch aaa \<and> (is_pt_cap aaa \<or> is_pd_cap aaa \<longrightarrow> cap_asid aaa \<noteq> None)) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<longrightarrow> table_cap_ref c = table_cap_ref aaa \<and> pt_pd_asid c = pt_pd_asid aaa) (ab, ba) and ?Q220 aa aaa ab ba ac\<rbrace>
 5. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 aa aaa ab ba ac\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) and valid_cap' ac and ?Q'220 aa aaa ab ba ac\<rbrace>
 6. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q202 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'202 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 9. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 10. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>aa aaa ab ba ac cura. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> corres dc (?R226 aa aaa ab ba ac cura) (?R'226 aa aaa ab ba ac cura) (when (cura = a) reschedule_required) (when (cura = a) rescheduleRequired)
 2. \<And>a aa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (a, Some (aa, ab, ba)); g' = Some (a, Some (ac, cte_map (ab, ba))); cap_relation aa ac; is_aligned a msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 a aa ab ba ac\<rbrace> gets cur_thread \<lbrace>?R226 a aa ab ba ac\<rbrace>
 3. \<And>a aa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (a, Some (aa, ab, ba)); g' = Some (a, Some (ac, cte_map (ab, ba))); cap_relation aa ac; is_aligned a msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'226 a aa ab ba ac\<rbrace> getCurThread \<lbrace>?R'226 a aa ab ba ac\<rbrace>
 4. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q220 aa aaa ab ba ac\<rbrace> check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4))) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q226 aa aaa ab ba ac\<rbrace>
 5. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'220 aa aaa ab ba ac\<rbrace> checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4))))) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q'226 aa aaa ab ba ac\<rbrace>
 6. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q202 aa aaa ab ba ac\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. einvs and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 4) and cte_wp_at (\<lambda>_. True) slot and K (is_cnode_or_valid_arch aaa \<and> (is_pt_cap aaa \<or> is_pd_cap aaa \<longrightarrow> cap_asid aaa \<noteq> None)) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<longrightarrow> table_cap_ref c = table_cap_ref aaa \<and> pt_pd_asid c = pt_pd_asid aaa) (ab, ba) and ?Q220 aa aaa ab ba ac\<rbrace>
 7. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 aa aaa ab ba ac\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) and valid_cap' ac and ?Q'220 aa aaa ab ba ac\<rbrace>
 8. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q202 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'202 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 aa aaa ab ba ac\<rbrace> gets cur_thread \<lbrace>\<lambda>cura x. cura = a \<longrightarrow> (weak_valid_sched_action and valid_etcbs) x\<rbrace>
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'226 aa aaa ab ba ac\<rbrace> getCurThread \<lbrace>\<lambda>cura x. cura = a \<longrightarrow> (Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) x\<rbrace>
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q220 aa aaa ab ba ac\<rbrace> check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4))) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q226 aa aaa ab ba ac\<rbrace>
 4. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'220 aa aaa ab ba ac\<rbrace> checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4))))) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q'226 aa aaa ab ba ac\<rbrace>
 5. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q202 aa aaa ab ba ac\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. einvs and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 4) and cte_wp_at (\<lambda>_. True) slot and K (is_cnode_or_valid_arch aaa \<and> (is_pt_cap aaa \<or> is_pd_cap aaa \<longrightarrow> cap_asid aaa \<noteq> None)) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<longrightarrow> table_cap_ref c = table_cap_ref aaa \<and> pt_pd_asid c = pt_pd_asid aaa) (ab, ba) and ?Q220 aa aaa ab ba ac\<rbrace>
 6. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 aa aaa ab ba ac\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) and valid_cap' ac and ?Q'220 aa aaa ab ba ac\<rbrace>
 7. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q202 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'202 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 10. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
A total of 12 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?P'243 aa aaa ab ba ac\<rbrace> check_cap_at aaa (ab, ba) (check_cap_at (cap.ThreadCap a) slot (cap_insert aaa (ab, ba) (a, tcb_cnode_index 4))) \<lbrace>\<lambda>rv s. cur_thread s = a \<longrightarrow> (weak_valid_sched_action and valid_etcbs) s\<rbrace>
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'220 aa aaa ab ba ac\<rbrace> checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4))))) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. ksCurThread s = a \<longrightarrow> (Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s)\<rbrace>
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q202 aa aaa ab ba ac\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. einvs and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 4) and cte_wp_at (\<lambda>_. True) slot and K (is_cnode_or_valid_arch aaa \<and> (is_pt_cap aaa \<or> is_pd_cap aaa \<longrightarrow> cap_asid aaa \<noteq> None)) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<longrightarrow> table_cap_ref c = table_cap_ref aaa \<and> pt_pd_asid c = pt_pd_asid aaa) (ab, ba) and (\<lambda>s. True \<and> ?P'243 aa aaa ab ba ac s)\<rbrace>
 4. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 aa aaa ab ba ac\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) and valid_cap' ac and ?Q'220 aa aaa ab ba ac\<rbrace>
 5. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q202 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'202 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 8. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 9. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 10. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (9 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'220 aa aaa ab ba ac\<rbrace> checkCapAt ac (cte_map (ab, ba)) (checkCapAt (capability.ThreadCap a) (cte_map slot) (assertDerived (cte_map (ab, ba)) ac (cteInsert ac (cte_map (ab, ba)) (cte_map (a, tcb_cnode_index 4))))) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. ksCurThread s = a \<longrightarrow> (Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s)\<rbrace>
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q202 aa aaa ab ba ac\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. einvs and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 4) and cte_wp_at (\<lambda>_. True) slot and K (is_cnode_or_valid_arch aaa \<and> (is_pt_cap aaa \<or> is_pd_cap aaa \<longrightarrow> cap_asid aaa \<noteq> None)) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<longrightarrow> table_cap_ref c = table_cap_ref aaa \<and> pt_pd_asid c = pt_pd_asid aaa) (ab, ba) and (\<lambda>s. True \<and> (einvs and simple_sched_action) s)\<rbrace>
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 aa aaa ab ba ac\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) and valid_cap' ac and ?Q'220 aa aaa ab ba ac\<rbrace>
 4. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q202 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'202 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 7. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 9. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (8 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q202 aa aaa ab ba ac\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. einvs and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 4) and cte_wp_at (\<lambda>_. True) slot and K (is_cnode_or_valid_arch aaa \<and> (is_pt_cap aaa \<or> is_pd_cap aaa \<longrightarrow> cap_asid aaa \<noteq> None)) and cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<longrightarrow> table_cap_ref c = table_cap_ref aaa \<and> pt_pd_asid c = pt_pd_asid aaa) (ab, ba) and (\<lambda>s. True \<and> (einvs and simple_sched_action) s)\<rbrace>
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 aa aaa ab ba ac\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x. invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) and valid_cap' ac and (\<lambda>s. True \<and> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) and valid_cap' ac) s)\<rbrace>
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and ?Q202 aa aaa ab ba ac and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'202 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 6. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 7. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 8. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (7 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; is_aligned aa msg_align_bits; isArchObjectCap ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'202 aa aaa ab ba ac\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. aa)) a \<lbrace>\<lambda>x s. invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) s \<and> valid_cap' ac s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) s \<and> valid_cap' ac s\<rbrace>
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q195 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>x. tcb_at a and (\<lambda>s. (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 4)) s \<and> valid_list s \<and> valid_sched s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 4) s \<and> cte_wp_at (\<lambda>a. True) slot s \<and> K (is_cnode_or_valid_arch aaa \<and> (is_pt_cap aaa \<or> is_pd_cap aaa \<longrightarrow> cap_asid aaa \<noteq> None)) s \<and> cte_wp_at (\<lambda>a. obj_refs a = obj_refs aaa \<longrightarrow> table_cap_ref a = table_cap_ref aaa \<and> pt_pd_asid a = pt_pd_asid aaa) (ab, ba) s \<and> True \<and> (invs and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 4)) s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s) and (\<lambda>s. is_aligned aa msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and ?Q'202 aa aaa ab ba ac and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and ?Q195 aa aaa ab ba ac) s
 5. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 6. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 7. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (6 subgoals):
 1. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?P'339 aa aaa ab ba ac\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>rv s. cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 4) s \<and> valid_list s \<and> valid_sched s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 4) s \<and> cte_wp_at (\<lambda>a. True) slot s \<and> is_cnode_or_valid_arch aaa \<and> (is_pt_cap aaa \<longrightarrow> (\<exists>y. cap_asid aaa = Some y)) \<and> (is_pd_cap aaa \<longrightarrow> (\<exists>y. cap_asid aaa = Some y)) \<and> cte_wp_at (\<lambda>a. obj_refs a = obj_refs aaa \<longrightarrow> table_cap_ref a = table_cap_ref aaa \<and> pt_pd_asid a = pt_pd_asid aaa) (ab, ba) s \<and> invs s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 4) s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> is_aligned aa msg_align_bits\<rbrace>, -
 2. \<And>aa aaa ab ba ac. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac\<rbrakk> \<Longrightarrow> \<lbrace>?Q'195 aa aaa ab ba ac\<rbrace> cteDelete (cte_map (a, tcb_cnode_index 4)) True \<lbrace>\<lambda>x. tcb_at' a and (\<lambda>s. (invs' s \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. aa) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. aa) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. aa) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. aa) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) s \<and> valid_cap' ac s \<and> (invs' s \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. aa) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. aa) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. aa) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. aa) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, tcb_cnode_index 4)) s \<and> valid_cap' ac s) and (\<lambda>s. isArchObjectCap ac)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (einvs and simple_sched_action and tcb_at a and (\<lambda>s. cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp cap.NullCap s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa \<and> cte_wp_at (\<lambda>_. True) slot s \<and> no_cap_to_obj_dr_emp aaa s \<and> s \<turnstile> aaa) and (\<lambda>y. is_cnode_or_valid_arch aaa \<and> is_arch_cap aaa \<and> valid_ipc_buffer_cap aaa aa \<and> is_aligned aa msg_align_bits) and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4)) s\<rbrakk> \<Longrightarrow> (einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) and emptyable (a, tcb_cnode_index 4) and (\<lambda>s. True \<and> tcb_at a s \<and> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> ?P'339 aa aaa ab ba ac s)) s
 4. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and ?Q'195 aa aaa ab ba ac) s
 5. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 6. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (4 subgoals):
 1. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; invs s; valid_list s; valid_sched s; simple_sched_action s; tcb_at a s; no_cap_to_obj_dr_emp cap.NullCap s; cte_wp_at (\<lambda>_. True) (ab, ba) s; cte_wp_at (\<lambda>_. True) slot s; no_cap_to_obj_dr_emp aaa s; s \<turnstile> aaa; is_cnode_or_valid_arch aaa; is_arch_cap aaa; valid_ipc_buffer_cap aaa aa; is_aligned aa msg_align_bits; cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s\<rbrakk> \<Longrightarrow> emptyable (a, tcb_cnode_index 4) s \<and> (is_pt_cap aaa \<longrightarrow> (\<exists>y. cap_asid aaa = Some y)) \<and> (is_pd_cap aaa \<longrightarrow> (\<exists>y. cap_asid aaa = Some y)) \<and> emptyable (a, tcb_cnode_index 4) s
 2. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and (\<lambda>s. True \<and> tcb_at' a s \<and> (invs' and sch_act_simple and K True) s \<and> tcb_at' a s \<and> True \<and> valid_cap' ac s \<and> (invs' and sch_act_simple and K True) s \<and> tcb_at' a s \<and> True \<and> valid_cap' ac s \<and> isArchObjectCap ac)) s
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 4. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (4 subgoals):
 1. \<And>aa aaa ab ba ac s cap capa capb. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; invs s; valid_list s; valid_sched s; simple_sched_action s; tcb_at a s; no_cap_to_obj_dr_emp cap.NullCap s; no_cap_to_obj_dr_emp aaa s; s \<turnstile> aaa; is_arch_cap aaa; valid_ipc_buffer_cap aaa aa; is_aligned aa msg_align_bits; caps_of_state s (ab, ba) = Some cap; caps_of_state s slot = Some capa; caps_of_state s (a, tcb_cnode_index 4) = Some capb; is_pt_cap aaa \<longrightarrow> (\<exists>y. cap_asid aaa = Some y); is_pd_cap aaa \<longrightarrow> (\<exists>y. cap_asid aaa = Some y)\<rbrakk> \<Longrightarrow> emptyable (a, tcb_cnode_index 4) s
 2. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and (\<lambda>s. True \<and> tcb_at' a s \<and> (invs' and sch_act_simple and K True) s \<and> tcb_at' a s \<and> True \<and> valid_cap' ac s \<and> (invs' and sch_act_simple and K True) s \<and> tcb_at' a s \<and> True \<and> valid_cap' ac s \<and> isArchObjectCap ac)) s
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 4. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (3 subgoals):
 1. \<And>aa aaa ab ba ac s. \<lbrakk>sl' = cte_map slot; g = Some (aa, Some (aaa, ab, ba)); g' = Some (aa, Some (ac, cte_map (ab, ba))); cap_relation aaa ac; (invs' and sch_act_simple and tcb_at' a and valid_cap' ac and (\<lambda>y. is_aligned aa msg_align_bits \<and> isArchObjectCap ac) and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) and (\<lambda>s. True \<and> tcb_at' a s \<and> (invs' and sch_act_simple and K True) s \<and> tcb_at' a s \<and> True \<and> valid_cap' ac s \<and> (invs' and sch_act_simple and K True) s \<and> tcb_at' a s \<and> True \<and> valid_cap' ac s \<and> isArchObjectCap ac)) s
 2. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 3. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (xa, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) \<and> (case g of None \<Rightarrow> True | Some (xa, None) \<Rightarrow> True | Some (xa, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c xa \<and> is_aligned xa msg_align_bits)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 2. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (2 subgoals):
 1. \<And>s tcb. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; (\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot; invs s; (\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot; (\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot; valid_list s; valid_sched s; simple_sched_action s; \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c; case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits; kheap s a = Some (TCB tcb)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 4) s
 2. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = cte_map ptr) g'' g'''; ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = cte_map slot) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = cte_map slot); invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (xa, None) \<Rightarrow> {} | Some (xa, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some (xa, v) \<Rightarrow> is_aligned xa msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, xa) \<Rightarrow> isArchObjectCap ac))\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 4)) s proof (prove)
goal (1 subgoal):
 1. \<And>s obj. \<lbrakk>case g of None \<Rightarrow> g' = None | Some (vptr, g'') \<Rightarrow> \<exists>g'''. g' = Some (vptr, g''') \<and> opt_rel (\<lambda>(cap, ptr) (cap', ptr'). cap_relation cap cap' \<and> ptr' = (case ptr of (oref, cref) \<Rightarrow> oref + of_bl cref * 2 ^ cte_level_bits)) g'' g'''; (\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> sl' = (case slot of (oref, cref) \<Rightarrow> oref + of_bl cref * 2 ^ cte_level_bits); invs' s; (\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> sl' = (case slot of (oref, cref) \<Rightarrow> oref + of_bl cref * 2 ^ cte_level_bits); (\<exists>a b. g = Some (a, b)) \<longrightarrow> sl' = (case slot of (oref, cref) \<Rightarrow> oref + of_bl cref * 2 ^ cte_level_bits); sch_act_simple s; \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s; case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac); ksPSpace s a = Some (KOTCB obj); is_aligned a tcbBlockSizeBits; ps_clear a tcbBlockSizeBits s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (a + 4 * 2 ^ cte_level_bits) s proof (prove)
goal:
No subgoals! proof (state)
this:
corres (dc \<oplus> dc) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)) (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac))) (case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (cap.ThreadCap a) slot $ cap_insert new_cap src_slot (a, tcb_cnode_index 4);
cur <- gets cur_thread;
liftE $ when (cur = a) reschedule_required
od
odE) (case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot $ checkCapAt (capability.ThreadCap a) sl' $ assertDerived srcSlot newCap $ cteInsert newCap srcSlot bufferSlot;
cur <- getCurThread;
liftE $ when (cur = a) rescheduleRequired
od
odE
od)

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. getThreadCSpaceRoot a = return (cte_map (a, tcb_cnode_index 0)) proof (prove)
goal (1 subgoal):
 1. return a = return (cte_map (a, tcb_cnode_index 0)) proof (prove)
goal:
No subgoals! proof (state)
this:
getThreadCSpaceRoot a = return (cte_map (a, tcb_cnode_index 0))

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. getThreadVSpaceRoot a = return (cte_map (a, tcb_cnode_index 1)) proof (prove)
goal (1 subgoal):
 1. return (a + 2 ^ cteSizeBits) = return (cte_map (a, tcb_cnode_index (Suc 0))) proof (prove)
goal:
No subgoals! proof (state)
this:
getThreadVSpaceRoot a = return (cte_map (a, tcb_cnode_index 1))

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. \<And>x P Q R M. (\<And>y. x = Some y \<Longrightarrow> \<lbrace>P y\<rbrace> M y \<lbrace>Q\<rbrace>, \<lbrace>R\<rbrace>) \<Longrightarrow> \<lbrace>case x of None \<Rightarrow> Q () | Some x \<Rightarrow> P x\<rbrace> case x of None \<Rightarrow> returnOk () | Some x \<Rightarrow> M x \<lbrace>Q\<rbrace>, \<lbrace>R\<rbrace> proof (state)
this:
(\<And>y. ?x2 = Some y \<Longrightarrow> \<lbrace>?P2 y\<rbrace> ?M2 y \<lbrace>?Q2\<rbrace>, \<lbrace>?R2\<rbrace>) \<Longrightarrow> \<lbrace>case ?x2 of None \<Rightarrow> ?Q2 () | Some x \<Rightarrow> ?P2 x\<rbrace> case ?x2 of None \<Rightarrow> returnOk () | Some x \<Rightarrow> ?M2 x \<lbrace>?Q2\<rbrace>, \<lbrace>?R2\<rbrace>

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. \<And>x P Q M. (\<And>y. x = Some y \<Longrightarrow> \<lbrace>P y\<rbrace> M y \<lbrace>Q\<rbrace>, -) \<Longrightarrow> \<lbrace>case x of None \<Rightarrow> Q () | Some x \<Rightarrow> P x\<rbrace> case x of None \<Rightarrow> returnOk () | Some x \<Rightarrow> M x \<lbrace>Q\<rbrace>, - proof (state)
this:
(\<And>y. ?x3 = Some y \<Longrightarrow> \<lbrace>?P3 y\<rbrace> ?M3 y \<lbrace>?Q3\<rbrace>, -) \<Longrightarrow> \<lbrace>case ?x3 of None \<Rightarrow> ?Q3 () | Some x \<Rightarrow> ?P3 x\<rbrace> case ?x3 of None \<Rightarrow> returnOk () | Some x \<Rightarrow> ?M3 x \<lbrace>?Q3\<rbrace>, -

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. \<And>P f R Q x. \<lbrace>P\<rbrace> f \<lbrace>\<lambda>rv. Q and R\<rbrace> \<Longrightarrow> \<lbrace>P\<rbrace> f \<lbrace>\<lambda>rv. case x of None \<Rightarrow> Q | Some y \<Rightarrow> R\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>P f R Q x rv s. \<lbrakk>\<lbrace>P\<rbrace> f \<lbrace>\<lambda>rv. Q and R\<rbrace>; ?Q P f R Q x rv s\<rbrakk> \<Longrightarrow> (case x of None \<Rightarrow> Q | Some y \<Rightarrow> R) s
 2. \<And>P f R Q x. \<lbrace>P\<rbrace> f \<lbrace>\<lambda>rv. Q and R\<rbrace> \<Longrightarrow> \<lbrace>P\<rbrace> f \<lbrace>?Q P f R Q x\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>P f R Q x. \<lbrace>P\<rbrace> f \<lbrace>\<lambda>rv. Q and R\<rbrace> \<Longrightarrow> \<lbrace>P\<rbrace> f \<lbrace>?Q P f R Q x\<rbrace>
 2. \<And>P f R Q x rv s. \<lbrakk>\<lbrace>P\<rbrace> f \<lbrace>\<lambda>rv. Q and R\<rbrace>; ?Q P f R Q x rv s\<rbrakk> \<Longrightarrow> (case x of None \<Rightarrow> Q | Some y \<Rightarrow> R) s proof (prove)
goal (1 subgoal):
 1. \<And>P f R Q x rv s. \<lbrakk>\<lbrace>P\<rbrace> f \<lbrace>\<lambda>rv. Q and R\<rbrace>; (Q and R) s\<rbrakk> \<Longrightarrow> (case x of None \<Rightarrow> Q | Some y \<Rightarrow> R) s proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>?P4\<rbrace> ?f4 \<lbrace>\<lambda>rv. ?Q4 and ?R4\<rbrace> \<Longrightarrow> \<lbrace>?P4\<rbrace> ?f4 \<lbrace>\<lambda>rv. case ?x4 of None \<Rightarrow> ?Q4 | Some y \<Rightarrow> ?R4\<rbrace>

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. \<And>x P Q M. (\<And>y. x = Some y \<Longrightarrow> \<lbrace>P y\<rbrace> M y \<lbrace>Q\<rbrace>) \<Longrightarrow> \<lbrace>case x of None \<Rightarrow> Q () | Some x \<Rightarrow> P x\<rbrace> case x of None \<Rightarrow> return () | Some x \<Rightarrow> M x \<lbrace>Q\<rbrace> proof (state)
this:
(\<And>y. ?x5 = Some y \<Longrightarrow> \<lbrace>?P5 y\<rbrace> ?M5 y \<lbrace>?Q5\<rbrace>) \<Longrightarrow> \<lbrace>case ?x5 of None \<Rightarrow> ?Q5 () | Some x \<Rightarrow> ?P5 x\<rbrace> case ?x5 of None \<Rightarrow> return () | Some x \<Rightarrow> ?M5 x \<lbrace>?Q5\<rbrace>

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. \<And>t v. \<lbrace>invs' and tcb_at' t\<rbrace> threadSet (tcbFaultHandler_update v) t \<lbrace>\<lambda>rv. invs'\<rbrace> proof (state)
this:
\<lbrace>invs' and tcb_at' ?t6\<rbrace> threadSet (tcbFaultHandler_update ?v6) ?t6 \<lbrace>\<lambda>rv. invs'\<rbrace>

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (state)
this:
\<lbrace>?P4\<rbrace> ?f4 \<lbrace>\<lambda>rv. ?Q4 and ?R4\<rbrace> \<Longrightarrow> \<lbrace>?P4\<rbrace> ?f4 \<lbrace>\<lambda>rv. case ?x4 of None \<Rightarrow> ?Q4 | Some y \<Rightarrow> ?R4\<rbrace>
\<lbrace>invs' and tcb_at' ?t6\<rbrace> threadSet (tcbFaultHandler_update ?v6) ?t6 \<lbrace>\<lambda>rv. invs'\<rbrace>
\<lbrakk>\<And>tcb v. case (tcb_ctable, tcb_ctable_update, \<lambda>_ _ _. True) of (getF, setF) \<Rightarrow> getF (?fn v tcb) = getF tcb; \<And>tcb v. case (tcb_vtable, tcb_vtable_update, \<lambda>_ _. is_valid_vtable_root or (=) cap.NullCap) of (getF, setF) \<Rightarrow> getF (?fn v tcb) = getF tcb; \<And>tcb v. case (tcb_reply, tcb_reply_update, \<lambda>t st c. is_master_reply_cap c \<and> obj_ref_of c = t \<and> AllowGrant \<in> cap_rights c \<or> halted st \<and> c = cap.NullCap) of (getF, setF) \<Rightarrow> getF (?fn v tcb) = getF tcb; \<And>tcb v. case (tcb_caller, tcb_caller_update, \<lambda>_ st. case st of Structures_A.thread_state.BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) of (getF, setF) \<Rightarrow> getF (?fn v tcb) = getF tcb; \<And>tcb v. case (tcb_ipcframe, tcb_ipcframe_update, \<lambda>_ _. is_nondevice_page_cap or (=) cap.NullCap) of (getF, setF) \<Rightarrow> getF (?fn v tcb) = getF tcb; \<And>tcb v. tcb_arch_ref (?fn v tcb) = tcb_arch_ref tcb; \<And>tcb v. tcb_state (?fn v tcb) = tcb_state tcb; \<And>tcb v. tcb_bound_notification (?fn v tcb) = tcb_bound_notification tcb; \<And>tcb v. tcb_iarch (?fn v tcb) = tcb_iarch tcb; \<And>tcb v. tcb_ipc_buffer (?fn v tcb) = tcb_ipc_buffer tcb \<or> tcb_ipc_buffer (?fn v tcb) = 0; \<And>tcb v'. ?v = Some v' \<Longrightarrow> tcb_fault_handler (?fn v' tcb) \<noteq> tcb_fault_handler tcb \<longrightarrow> length (tcb_fault_handler (?fn v' tcb)) = word_bits; \<And>tcb v. tcb_fault (?fn v tcb) \<noteq> tcb_fault tcb \<longrightarrow> (case tcb_fault (?fn v tcb) of None \<Rightarrow> True | Some f \<Rightarrow> valid_fault f)\<rbrakk> \<Longrightarrow> \<lbrace>invs\<rbrace> option_update_thread ?t ?fn ?v \<lbrace>\<lambda>rv. invs\<rbrace>
\<lbrakk>\<lbrace>?P\<rbrace> ?f None \<lbrace>?Q\<rbrace>; \<And>x. \<lbrace>?P' x\<rbrace> ?f (Some x) \<lbrace>?Q' x\<rbrace>\<rbrakk> \<Longrightarrow> \<lbrace>case ?v of None \<Rightarrow> ?P | Some x \<Rightarrow> ?P' x\<rbrace> ?f ?v \<lbrace>\<lambda>rv. case ?v of None \<Rightarrow> ?Q rv | Some x \<Rightarrow> ?Q' x rv\<rbrace>
(\<And>x. x \<in> ?S \<Longrightarrow> \<lbrace>?P x\<rbrace> ?f \<lbrace>?Q x\<rbrace>) \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>?S. ?P x s\<rbrace> ?f \<lbrace>\<lambda>rv s. \<forall>x\<in>?S. ?Q x rv s\<rbrace>
(\<And>x. x \<in> ?S \<Longrightarrow> \<lbrace>?P x\<rbrace> ?f \<lbrace>?Q x\<rbrace>, -) \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>?S. ?P x s\<rbrace> ?f \<lbrace>\<lambda>rv s. \<forall>x\<in>?S. ?Q x rv s\<rbrace>, -
\<lbrace>\<lambda>_. True\<rbrace> cap_delete ?p \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>c. c = cap.NullCap) ?p\<rbrace>, -
\<lbrace>valid_cap ?c\<rbrace> cap_delete ?p \<lbrace>\<lambda>_. valid_cap ?c\<rbrace>
\<lbrace>valid_objs and K (\<forall>p s t x. valid_tcb p t s \<longrightarrow> valid_tcb p (?f x t) s)\<rbrace> option_update_thread ?a ?f ?t \<lbrace>\<lambda>rv. valid_objs\<rbrace>
\<lbrace>valid_objs and valid_cap ?cap and tcb_cap_valid ?cap ?dest\<rbrace> cap_insert ?cap ?src ?dest \<lbrace>\<lambda>rv. valid_objs\<rbrace>
\<lbrace>\<lambda>_. True\<rbrace> cteDelete ?slot True \<lbrace>\<lambda>rv. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) ?slot\<rbrace>, -
\<lbrace>invs' and sch_act_simple and (\<lambda>s. \<not> ?exposed \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) ?slot s)\<rbrace> cteDelete ?slot ?exposed \<lbrace>\<lambda>rv. sch_act_simple\<rbrace>
\<lbrace>valid_cap ?c\<rbrace> option_update_thread ?t ?fn ?v \<lbrace>\<lambda>rv. valid_cap ?c\<rbrace>
\<lbrace>cte_wp_at (\<lambda>_. True) ?c\<rbrace> option_update_thread ?t ?fn ?v \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>_. True) ?c\<rbrace>
\<lbrakk>\<And>tcb v. tcb_state (?fn v tcb) = tcb_state tcb; \<And>tcb v. tcb_ipc_buffer (?fn v tcb) = tcb_ipc_buffer tcb \<or> tcb_ipc_buffer (?fn v tcb) = 0\<rbrakk> \<Longrightarrow> \<lbrace>tcb_cap_valid ?c ?p\<rbrace> option_update_thread ?t ?fn ?v \<lbrace>\<lambda>rv. tcb_cap_valid ?c ?p\<rbrace>
(\<And>tcb v. tcb_state (?fn v tcb) = tcb_state tcb) \<Longrightarrow> \<lbrace>emptyable ?sl\<rbrace> option_update_thread ?t ?fn ?v \<lbrace>\<lambda>rv. emptyable ?sl\<rbrace>
\<lbrace>valid_cap ?c\<rbrace> cap_insert ?cap ?src ?dest \<lbrace>\<lambda>rv. valid_cap ?c\<rbrace>
\<lbrace>cte_wp_at (\<lambda>_. True) ?p\<rbrace> cap_insert ?cap ?src ?dest \<lbrace>\<lambda>_. cte_wp_at (\<lambda>_. True) ?p\<rbrace>
\<lbrace>cte_wp_at (\<lambda>_. True) ?c\<rbrace> cap_delete ?p \<lbrace>\<lambda>_. cte_wp_at (\<lambda>_. True) ?c\<rbrace>
\<lbrace>tcb_at ?t\<rbrace> cap_delete ?ptr \<lbrace>\<lambda>rv. tcb_at ?t\<rbrace>
\<lbrace>invs' and sch_act_simple and K ?ex\<rbrace> cteDelete ?ptr ?ex \<lbrace>\<lambda>rv. invs'\<rbrace>
\<lbrace>valid_cap' ?c0.8\<rbrace> ?f \<lbrace>\<lambda>rv. valid_cap' ?c0.8\<rbrace> \<Longrightarrow> \<lbrace>valid_cap' ?c0.8\<rbrace> checkCapAt ?cap ?slot ?f \<lbrace>\<lambda>rv. valid_cap' ?c0.8\<rbrace>
\<lbrace>tcb_at ?p0.9\<rbrace> ?f \<lbrace>\<lambda>rv. tcb_at ?p0.9\<rbrace> \<Longrightarrow> \<lbrace>tcb_at ?p0.9\<rbrace> check_cap_at ?cap ?slot ?f \<lbrace>\<lambda>rv. tcb_at ?p0.9\<rbrace>
\<lbrace>tcb_at' ?p0.8\<rbrace> ?f \<lbrace>\<lambda>rv. tcb_at' ?p0.8\<rbrace> \<Longrightarrow> \<lbrace>tcb_at' ?p0.8\<rbrace> checkCapAt ?cap ?slot ?f \<lbrace>\<lambda>rv. tcb_at' ?p0.8\<rbrace>
\<lbrace>cte_wp_at (\<lambda>_. True) ?p0.9\<rbrace> ?f \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>_. True) ?p0.9\<rbrace> \<Longrightarrow> \<lbrace>cte_wp_at (\<lambda>_. True) ?p0.9\<rbrace> check_cap_at ?cap ?slot ?f \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>_. True) ?p0.9\<rbrace>
\<lbrace>cte_wp_at' (\<lambda>_. True) ?p0.8\<rbrace> ?f \<lbrace>\<lambda>rv. cte_wp_at' (\<lambda>_. True) ?p0.8\<rbrace> \<Longrightarrow> \<lbrace>cte_wp_at' (\<lambda>_. True) ?p0.8\<rbrace> checkCapAt ?cap ?slot ?f \<lbrace>\<lambda>rv. cte_wp_at' (\<lambda>_. True) ?p0.8\<rbrace>
\<lbrace>valid_cap ?c9\<rbrace> ?f \<lbrace>\<lambda>rv. valid_cap ?c9\<rbrace> \<Longrightarrow> \<lbrace>\<lambda>x. x \<turnstile> ?c9\<rbrace> check_cap_at ?cap ?slot ?f \<lbrace>\<lambda>rv. valid_cap ?c9\<rbrace>
\<lbrace>valid_cap' ?c8\<rbrace> ?f \<lbrace>\<lambda>rv. valid_cap' ?c8\<rbrace> \<Longrightarrow> \<lbrace>valid_cap' ?c8\<rbrace> checkCapAt ?cap ?slot ?f \<lbrace>\<lambda>rv. valid_cap' ?c8\<rbrace>
\<lbrace>tcb_cap_valid ?c9 ?p1.9\<rbrace> ?f \<lbrace>\<lambda>rv. tcb_cap_valid ?c9 ?p1.9\<rbrace> \<Longrightarrow> \<lbrace>tcb_cap_valid ?c9 ?p1.9\<rbrace> check_cap_at ?cap ?slot ?f \<lbrace>\<lambda>rv. tcb_cap_valid ?c9 ?p1.9\<rbrace>
\<lbrace>valid_sched\<rbrace> ?f \<lbrace>\<lambda>rv. valid_sched\<rbrace> \<Longrightarrow> \<lbrace>valid_sched\<rbrace> check_cap_at ?cap ?slot ?f \<lbrace>\<lambda>rv. valid_sched\<rbrace>
\<lbrace>simple_sched_action\<rbrace> ?f \<lbrace>\<lambda>rv. simple_sched_action\<rbrace> \<Longrightarrow> \<lbrace>simple_sched_action\<rbrace> check_cap_at ?cap ?slot ?f \<lbrace>\<lambda>rv. simple_sched_action\<rbrace>
\<lbrace>sch_act_simple\<rbrace> ?f \<lbrace>\<lambda>rv. sch_act_simple\<rbrace> \<Longrightarrow> \<lbrace>sch_act_simple\<rbrace> checkCapAt ?cap ?slot ?f \<lbrace>\<lambda>rv. sch_act_simple\<rbrace>
\<lbrakk>\<And>tcb v. case (tcb_ctable, tcb_ctable_update, \<lambda>_ _ _. True) of (getF, x) \<Rightarrow> getF (?f v tcb) = getF tcb; \<And>tcb v. case (tcb_vtable, tcb_vtable_update, \<lambda>_ _. is_valid_vtable_root or (=) cap.NullCap) of (getF, x) \<Rightarrow> getF (?f v tcb) = getF tcb; \<And>tcb v. case (tcb_reply, tcb_reply_update, \<lambda>t st c. is_master_reply_cap c \<and> obj_ref_of c = t \<and> AllowGrant \<in> cap_rights c \<or> halted st \<and> c = cap.NullCap) of (getF, x) \<Rightarrow> getF (?f v tcb) = getF tcb; \<And>tcb v. case (tcb_caller, tcb_caller_update, \<lambda>_ st. case st of Structures_A.thread_state.BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) of (getF, x) \<Rightarrow> getF (?f v tcb) = getF tcb; \<And>tcb v. case (tcb_ipcframe, tcb_ipcframe_update, \<lambda>_ _. is_nondevice_page_cap or (=) cap.NullCap) of (getF, x) \<Rightarrow> getF (?f v tcb) = getF tcb\<rbrakk> \<Longrightarrow> \<lbrace>no_cap_to_obj_with_diff_ref ?cap ?S\<rbrace> option_update_thread ?a ?f ?t \<lbrace>\<lambda>rv. no_cap_to_obj_with_diff_ref ?cap ?S\<rbrace>
\<lbrace>no_cap_to_obj_dr_emp ?c' and no_cap_to_obj_dr_emp ?a\<rbrace> check_cap_at ?a ?b (check_cap_at ?c ?d (cap_insert ?a ?b ?e)) \<lbrace>\<lambda>r. no_cap_to_obj_dr_emp ?c'\<rbrace>

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (state)
this:
\<lbrakk>?b = ?c; ?c \<Longrightarrow> ?x = ?u; \<not> ?c \<Longrightarrow> ?y = ?v\<rbrakk> \<Longrightarrow> (if ?b then ?x else ?y) = (if ?c then ?u else ?v)
\<lbrakk>?option = ?option'; ?option' = None \<Longrightarrow> ?f1.0 = ?g1.0; \<And>x2. ?option' = Some x2 \<Longrightarrow> ?f2.0 x2 = ?g2.0 x2\<rbrakk> \<Longrightarrow> (case ?option of None \<Rightarrow> ?f1.0 | Some x2 \<Rightarrow> ?f2.0 x2) = (case ?option' of None \<Rightarrow> ?g1.0 | Some x2 \<Rightarrow> ?g2.0 x2)

goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g')) proof (prove)
goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (do y <- option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b');
y <- case mcp_auth of None \<Rightarrow> return () | Some (newmcp, xa) \<Rightarrow> set_mcpriority a newmcp;
doE y <- case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE;
y <- case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE;
y <- case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (a = cur) reschedule_required)
od
odE;
do y <- case p_auth of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> set_priority a prio;
returnOk []
od
odE
od) (do y <- case b' of None \<Rightarrow> return () | Some ep \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>_. ep)) a;
y <- case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2);
doE y <- case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (a = thread) rescheduleRequired)
od
odE
od;
do y <- case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2);
returnOk []
od
odE
od) proof (prove)
goal (1 subgoal):
 1. corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (do y <- option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b');
y <- case mcp_auth of None \<Rightarrow> return () | Some (newmcp, xa) \<Rightarrow> set_mcpriority a newmcp;
doE y <- case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE;
y <- case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE;
y <- case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE;
do y <- case p_auth of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> set_priority a prio;
returnOk []
od
odE
od) (do y <- case b' of None \<Rightarrow> return () | Some ep \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>_. ep)) a;
y <- case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2);
doE y <- case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od;
do y <- case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2);
returnOk []
od
odE
od) proof (prove)
goal (3 subgoals):
 1. corres (dc \<oplus> (=)) ?Q46 ?Q'46 (do y <- option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b');
y <- case mcp_auth of None \<Rightarrow> return () | Some (newmcp, xa) \<Rightarrow> set_mcpriority a newmcp;
doE y <- case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE;
y <- case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE;
y <- case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE;
do y <- case p_auth of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> set_priority a prio;
returnOk []
od
odE
od) (do y <- case b' of None \<Rightarrow> return () | Some ep \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>_. ep)) a;
y <- case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2);
doE y <- case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od;
do y <- case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2);
returnOk []
od
odE
od)
 2. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> ?Q46 s
 3. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> ?Q'46 s proof (prove)
goal (5 subgoals):
 1. corres (dc \<oplus> (=)) ?R50 ?R'50 (do y <- case mcp_auth of None \<Rightarrow> return () | Some (newmcp, xa) \<Rightarrow> set_mcpriority a newmcp;
doE y <- case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE;
y <- case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE;
y <- case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE;
do y <- case p_auth of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> set_priority a prio;
returnOk []
od
odE
od) (do y <- case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2);
doE y <- case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od;
do y <- case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2);
returnOk []
od
odE
od)
 2. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. ?R50\<rbrace>
 3. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. ?R'50\<rbrace>
 4. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 5. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (7 subgoals):
 1. corres (dc \<oplus> (=)) ?R55 ?R'55 (doE y <- case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE;
y <- case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE;
y <- case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE;
do y <- case p_auth of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> set_priority a prio;
returnOk []
od
odE) (doE y <- case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od;
do y <- case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2);
returnOk []
od
odE)
 2. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. ?R55\<rbrace>
 3. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. ?R'55\<rbrace>
 4. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 5. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 6. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 7. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (9 subgoals):
 1. corres (dc \<oplus> (=)) ?R65 ?R'65 (doE y <- case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE;
y <- case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE;
do y <- case p_auth of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> set_priority a prio;
returnOk []
od
odE) (doE y <- case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od;
y <- case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od;
do y <- case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2);
returnOk []
od
odE)
 2. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. ?R65\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. ?R'65\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 5. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 6. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 7. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 8. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 9. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (11 subgoals):
 1. corres (dc \<oplus> (=)) ?R77 ?R'77 (doE y <- case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE;
do y <- case p_auth of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> set_priority a prio;
returnOk []
od
odE) (doE y <- case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od;
do y <- case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2);
returnOk []
od
odE)
 2. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. ?R77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. ?R'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 7. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 8. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 9. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 10. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. corres (dc \<oplus> dc) ?P89 ?P'89 (case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE) (case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od)
 2. corres (dc \<oplus> (=)) ?R89 ?R'89 (do y <- case p_auth of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> set_priority a prio;
returnOk []
od) (do y <- case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2);
returnOk []
od)
 3. \<lbrace>?Q89\<rbrace> case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE \<lbrace>\<lambda>x. ?R89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'89\<rbrace> case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>x. ?R'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. ?P89 and ?Q89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. ?P'89 and ?Q'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 10. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. corres (dc \<oplus> (=)) ?R89 ?R'89 (do y <- case p_auth of None \<Rightarrow> return () | Some (prio, xa) \<Rightarrow> set_priority a prio;
returnOk []
od) (do y <- case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2);
returnOk []
od)
 2. \<lbrace>?Q89\<rbrace> case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE \<lbrace>\<lambda>x. ?R89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'89\<rbrace> case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>x. ?R'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and ?Q89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and ?Q'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 9. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 10. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. corres (dc \<oplus> (=)) ?R106 ?R'106 (returnOk []) (returnOk [])
 2. \<lbrace>?Q106\<rbrace> case p_auth of None \<Rightarrow> return () | Some (p, auth) \<Rightarrow> set_priority a p \<lbrace>\<lambda>x. ?R106\<rbrace>
 3. \<lbrace>?Q'106\<rbrace> case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2) \<lbrace>\<lambda>x. ?R'106\<rbrace>
 4. \<lbrace>?Q89\<rbrace> case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE \<lbrace>\<lambda>x. einvs and tcb_at a and ?Q106\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'89\<rbrace> case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>x. invs' and tcb_at' a and valid_objs' and (\<lambda>y. valid_option_prio p_auth) and ?Q'106\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and ?Q89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and ?Q'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<lbrace>?Q106\<rbrace> case p_auth of None \<Rightarrow> return () | Some (p, auth) \<Rightarrow> set_priority a p \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<lbrace>?Q'106\<rbrace> case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2) \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<lbrace>?Q89\<rbrace> case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE \<lbrace>\<lambda>x. einvs and tcb_at a and ?Q106\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'89\<rbrace> case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>x. invs' and tcb_at' a and valid_objs' and (\<lambda>y. valid_option_prio p_auth) and ?Q'106\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and ?Q89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and ?Q'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 10. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<lbrace>?Q'106\<rbrace> case p_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setPriority a (fst x2) \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<lbrace>?Q89\<rbrace> case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE \<lbrace>\<lambda>x. einvs and tcb_at a and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'89\<rbrace> case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>x. invs' and tcb_at' a and valid_objs' and (\<lambda>y. valid_option_prio p_auth) and ?Q'106\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and ?Q89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and ?Q'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 9. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 10. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrace>?Q89\<rbrace> case g of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 4);
do y <- thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 4)));
cur <- gets cur_thread;
liftE (when (cur = a) reschedule_required)
od
odE \<lbrace>\<lambda>x. einvs and tcb_at a and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?Q'89\<rbrace> case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>x. invs' and tcb_at' a and valid_objs' and (\<lambda>y. valid_option_prio p_auth) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and ?Q89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and ?Q'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 8. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 9. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 10. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1 xa ac bb. g = Some (x1, Some (xa, ac, bb)) \<Longrightarrow> \<lbrace>?P'544 ac bb (x1, Some (xa, ac, bb)) x1 (Some (xa, ac, bb)) (xa, ac, bb) xa (ac, bb)\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>a. obj_refs a = obj_refs xa \<longrightarrow> table_cap_ref a = table_cap_ref xa \<and> pt_pd_asid a = pt_pd_asid xa) (ac, bb)\<rbrace>, -
 2. \<And>x2 x1 x2a. \<lbrakk>g = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'508 x2 x1 x2a\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>rv s. ((x2a = None \<longrightarrow> valid_list s) \<and> (\<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> valid_list s))) \<and> ((x2a = None \<longrightarrow> valid_sched s) \<and> (\<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> valid_sched s))) \<and> ((x2a = None \<longrightarrow> tcb_at a s) \<and> (\<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at a s))) \<and> True\<rbrace>, -
 3. \<lbrace>?Q'89\<rbrace> case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>x. invs' and tcb_at' a and valid_objs' and (\<lambda>y. valid_option_prio p_auth) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>xc. xb = Some xc \<longrightarrow> (\<forall>xd xe. xc = (xd, xe) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xd) s \<and> s \<turnstile> xd \<and> (is_nondevice_page_cap xd \<and> (\<forall>ptr. valid_ipc_buffer_cap xd xa)) \<and> K (is_pt_cap xd \<or> is_pd_cap xd \<longrightarrow> cap_asid xd \<noteq> None) s \<and> ?P'544 (fst xe) (snd xe) x xa xb xc xd xe s)) \<and> ?P'508 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and ?Q'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 9. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 10. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1 xa ac bb. g = Some (x1, Some (xa, ac, bb)) \<Longrightarrow> \<lbrace>?P'544 ac bb (x1, Some (xa, ac, bb)) x1 (Some (xa, ac, bb)) (xa, ac, bb) xa (ac, bb)\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> no_cap_to_obj_dr_emp xa s \<and> s \<turnstile> xa \<and> invs s\<rbrace>, -
 2. \<And>x2 x1 x2a. \<lbrakk>g = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'508 x2 x1 x2a\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>rv s. ((x2a = None \<longrightarrow> valid_list s) \<and> (\<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> valid_list s))) \<and> ((x2a = None \<longrightarrow> valid_sched s) \<and> (\<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> valid_sched s))) \<and> ((x2a = None \<longrightarrow> tcb_at a s) \<and> (\<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at a s))) \<and> True\<rbrace>, -
 3. \<lbrace>?Q'89\<rbrace> case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>x. invs' and tcb_at' a and valid_objs' and (\<lambda>y. valid_option_prio p_auth) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>xc. xb = Some xc \<longrightarrow> (\<forall>xd xe. xc = (xd, xe) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xd) s \<and> s \<turnstile> xd \<and> (is_nondevice_page_cap xd \<and> (\<forall>ptr. valid_ipc_buffer_cap xd xa)) \<and> K (is_pt_cap xd \<or> is_pd_cap xd \<longrightarrow> cap_asid xd \<noteq> None) s \<and> ?P'544 (fst xe) (snd xe) x xa xb xc xd xe s)) \<and> ?P'508 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and ?Q'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 9. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 10. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>g = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'508 x2 x1 x2a\<rbrace> cap_delete (a, tcb_cnode_index 4) \<lbrace>\<lambda>rv s. ((x2a = None \<longrightarrow> valid_list s) \<and> (\<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> valid_list s))) \<and> ((x2a = None \<longrightarrow> valid_sched s) \<and> (\<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> valid_sched s))) \<and> ((x2a = None \<longrightarrow> tcb_at a s) \<and> (\<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at a s))) \<and> True\<rbrace>, -
 2. \<lbrace>?Q'89\<rbrace> case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>x. invs' and tcb_at' a and valid_objs' and (\<lambda>y. valid_option_prio p_auth) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> ?P'508 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and ?Q'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 8. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 9. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 10. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<lbrace>?Q'89\<rbrace> case g' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. ptr)) a;
y <- case frame of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>x. invs' and tcb_at' a and valid_objs' and (\<lambda>y. valid_option_prio p_auth) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and ?Q'89\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 7. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 8. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 9. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 10. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
A total of 11 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x2 x1 x2a bufferSlot y. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'688 x2 x1 x2a bufferSlot y\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a \<lbrace>\<lambda>rv s. \<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) bufferSlot and valid_cap' xa and K (capBadge xa = None) and K (bufferSlot \<in> cte_refs' (capability.ThreadCap a) 0) and K (\<not> isReplyCap xa \<and> \<not> isIRQControlCap xa)) s)\<rbrace>
 2. \<And>x2 x1 x2a bufferSlot y. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'643 x2 x1 x2a bufferSlot y\<rbrace> do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od \<lbrace>\<lambda>_. invs'\<rbrace>, -
 3. \<And>x2 x1 x2a bufferSlot. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?B640 x2 x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. ((x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> ?P'688 x2 x1 x2a bufferSlot y s) \<and> ?P'643 x2 x1 x2a bufferSlot y s\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 5. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 6. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x1 x2a bufferSlot. g' = Some (x1, x2a) \<Longrightarrow> \<lbrace>?P'688 (x1, x2a) x1 x2a bufferSlot ()\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a \<lbrace>\<lambda>rv s. \<forall>aa. (\<exists>b. x2a = Some (aa, b)) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) bufferSlot s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa\<rbrace>
 2. \<And>x2 x1 x2a bufferSlot y. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'643 x2 x1 x2a bufferSlot y\<rbrace> do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od \<lbrace>\<lambda>_. invs'\<rbrace>, -
 3. \<And>x2 x1 x2a bufferSlot. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?B640 x2 x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. ((x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> ?P'688 x2 x1 x2a bufferSlot y s) \<and> ?P'643 x2 x1 x2a bufferSlot y s\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 5. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 6. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x1 x2a bufferSlot aa. \<lbrakk>g' = Some (x1, x2a); \<exists>b. x2a = Some (aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'762 (x1, x2a) x1 x2a bufferSlot () aa\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) bufferSlot s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa\<rbrace>
 2. \<And>x2 x1 x2a bufferSlot y. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'643 x2 x1 x2a bufferSlot y\<rbrace> do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od \<lbrace>\<lambda>_. invs'\<rbrace>, -
 3. \<And>x2 x1 x2a bufferSlot. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?B640 x2 x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. ((x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> ?P'762 x2 x1 x2a bufferSlot y x s)) \<and> ?P'643 x2 x1 x2a bufferSlot y s\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 5. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 6. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x1 bufferSlot aa b. g' = Some (x1, Some (aa, b)) \<Longrightarrow> \<lbrace>?P'828 b (aa, b) (x1, Some (aa, b)) x1 (Some (aa, b)) bufferSlot () aa\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) bufferSlot s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa\<rbrace>
 2. \<And>x2 x1 x2a bufferSlot y. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'643 x2 x1 x2a bufferSlot y\<rbrace> do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od \<lbrace>\<lambda>_. invs'\<rbrace>, -
 3. \<And>x2 x1 x2a bufferSlot. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?B640 x2 x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. ((x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> ?P'828 (snd (the x2a)) (the x2a) x2 x1 x2a bufferSlot y x s)) \<and> ?P'643 x2 x1 x2a bufferSlot y s\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 5. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 6. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x2 x1 x2a bufferSlot y. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'643 x2 x1 x2a bufferSlot y\<rbrace> do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od \<lbrace>\<lambda>_. invs'\<rbrace>, -
 2. \<And>x2 x1 x2a bufferSlot. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?B640 x2 x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. ((x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) bufferSlot s \<and> valid_cap' x s \<and> capBadge x = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> ?P'643 x2 x1 x2a bufferSlot y s\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 4. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 5. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 10. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x2 x1 x2a bufferSlot y. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'888 x2 x1 x2a bufferSlot y\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a \<lbrace>\<lambda>rv s. \<forall>x. x2a = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) bufferSlot and valid_cap' xa and K (capBadge xa = None) and K (bufferSlot \<in> cte_refs' (capability.ThreadCap a) 0) and K (\<not> isReplyCap xa \<and> \<not> isIRQControlCap xa)) s)\<rbrace>
 2. \<And>x2 x1 x2a bufferSlot. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?B640 x2 x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. ((x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) bufferSlot s \<and> valid_cap' x s \<and> capBadge x = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> ?P'888 x2 x1 x2a bufferSlot y s\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 4. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 5. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 10. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x1 x2a bufferSlot. g' = Some (x1, x2a) \<Longrightarrow> \<lbrace>?P'888 (x1, x2a) x1 x2a bufferSlot ()\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a \<lbrace>\<lambda>rv s. \<forall>aa. (\<exists>b. x2a = Some (aa, b)) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) bufferSlot s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa\<rbrace>
 2. \<And>x2 x1 x2a bufferSlot. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?B640 x2 x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. ((x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) bufferSlot s \<and> valid_cap' x s \<and> capBadge x = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> ?P'888 x2 x1 x2a bufferSlot y s\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 4. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 5. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 10. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x1 x2a bufferSlot aa. \<lbrakk>g' = Some (x1, x2a); \<exists>b. x2a = Some (aa, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'961 (x1, x2a) x1 x2a bufferSlot () aa\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) bufferSlot s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa\<rbrace>
 2. \<And>x2 x1 x2a bufferSlot. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?B640 x2 x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. ((x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) bufferSlot s \<and> valid_cap' x s \<and> capBadge x = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> ?P'961 x2 x1 x2a bufferSlot y x s)\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 4. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 5. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 10. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x1 bufferSlot aa b. g' = Some (x1, Some (aa, b)) \<Longrightarrow> \<lbrace>?P'1027 b (aa, b) (x1, Some (aa, b)) x1 (Some (aa, b)) bufferSlot () aa\<rbrace> threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) bufferSlot s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa\<rbrace>
 2. \<And>x2 x1 x2a bufferSlot. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?B640 x2 x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. ((x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) bufferSlot s \<and> valid_cap' x s \<and> capBadge x = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> ?P'1027 (snd (the x2a)) (the x2a) x2 x1 x2a bufferSlot y x s)\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 4. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 5. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 10. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x2 x1 x2a bufferSlot. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?B640 x2 x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. ((x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) bufferSlot s \<and> valid_cap' x s \<and> capBadge x = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (x2a = None \<longrightarrow> invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> (invs' s \<and> (\<forall>tcb. is_aligned (tcbIPCBuffer (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) msg_align_bits) \<and> tcb_at' a s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> a \<notin> set (ksReadyQueues s (d, p))) \<and> (\<forall>ko d p. ko_at' ko a s \<and> inQ d p (tcbIPCBuffer_update (\<lambda>_. x1) ko) \<and> \<not> inQ d p ko \<longrightarrow> a \<in> set (ksReadyQueues s (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb)) \<longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> ksCurThread s) \<and> (\<forall>tcb. tcbQueued (tcbIPCBuffer_update (\<lambda>_. x1) tcb) \<and> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> a \<noteq> ksCurThread s)) \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) bufferSlot s \<and> valid_cap' x s \<and> capBadge x = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 3. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 4. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 9. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 10. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1 x2a bufferSlot. g' = Some (x1, x2a) \<Longrightarrow> \<lbrace>?B640 (x1, x2a) x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. (x2a = None \<longrightarrow> invs' s \<and> is_aligned x1 msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> invs' s \<and> is_aligned x1 msg_align_bits \<and> tcb_at' a s \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) bufferSlot s \<and> valid_cap' x s \<and> capBadge x = None \<and> bufferSlot \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P639 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B640 x2 x1 x2a\<rbrace>
 3. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True\<rbrace>, -
 4. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ?P639 x xa xb s \<and> ?P'639 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 9. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 10. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1 x2a bufferSlot. g' = Some (x1, x2a) \<Longrightarrow> \<lbrace>?B1662 (x1, x2a) x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>y s. (x2a = None \<longrightarrow> valid_objs' s \<and> (\<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbIPCBuffer_update (\<lambda>_. x1) tcb) s)) \<and> (\<forall>a. (\<exists>b. x2a = Some (a, b)) \<longrightarrow> valid_objs' s \<and> (\<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbIPCBuffer_update (\<lambda>_. x1) tcb) s) \<and> valid_cap' a s \<and> valid_objs' s \<and> (\<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbIPCBuffer_update (\<lambda>_. x1) tcb) s)) \<and> (x2a = None \<longrightarrow> valid_objs' s \<and> (\<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbIPCBuffer_update (\<lambda>_. x1) tcb) s)) \<and> (\<forall>a. (\<exists>b. x2a = Some (a, b)) \<longrightarrow> valid_objs' s \<and> (\<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbIPCBuffer_update (\<lambda>_. x1) tcb) s) \<and> valid_cap' a s \<and> valid_objs' s \<and> (\<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbIPCBuffer_update (\<lambda>_. x1) tcb) s))\<rbrace>, \<lbrace>\<lambda>_. valid_objs'\<rbrace>
 2. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P1661 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B1662 x2 x1 x2a\<rbrace>
 3. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1661 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. valid_option_prio p_auth \<and> True\<rbrace>, -
 4. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ?P1661 x xa xb s \<and> ?P'1661 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 9. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 10. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1 x2a bufferSlot. g' = Some (x1, x2a) \<Longrightarrow> \<lbrace>?B1662 (x1, x2a) x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>r s. (x2a = None \<longrightarrow> valid_objs' s \<and> is_aligned x1 msg_align_bits) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> valid_objs' s \<and> is_aligned x1 msg_align_bits \<and> valid_cap' x s \<and> valid_objs' s \<and> is_aligned x1 msg_align_bits) \<and> (x2a = None \<longrightarrow> valid_objs' s \<and> is_aligned x1 msg_align_bits) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> valid_objs' s \<and> is_aligned x1 msg_align_bits \<and> valid_cap' x s \<and> valid_objs' s \<and> is_aligned x1 msg_align_bits)\<rbrace>, \<lbrace>\<lambda>r. valid_objs'\<rbrace>
 2. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P1661 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B1662 x2 x1 x2a\<rbrace>
 3. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1661 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. valid_option_prio p_auth \<and> True\<rbrace>, -
 4. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ?P1661 x xa xb s \<and> ?P'1661 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 9. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 10. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1 x2a bufferSlot. g' = Some (x1, x2a) \<Longrightarrow> \<lbrace>?B1662 (x1, x2a) x1 x2a bufferSlot\<rbrace> cteDelete bufferSlot True \<lbrace>\<lambda>r s. (x2a = None \<longrightarrow> invs' s \<and> is_aligned x1 msg_align_bits) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> invs' s \<and> is_aligned x1 msg_align_bits \<and> valid_cap' x s \<and> invs' s \<and> is_aligned x1 msg_align_bits) \<and> (x2a = None \<longrightarrow> invs' s \<and> is_aligned x1 msg_align_bits) \<and> (\<forall>x. (\<exists>b. x2a = Some (x, b)) \<longrightarrow> invs' s \<and> is_aligned x1 msg_align_bits \<and> valid_cap' x s \<and> invs' s \<and> is_aligned x1 msg_align_bits)\<rbrace>, \<lbrace>\<lambda>r. invs'\<rbrace>
 2. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P1661 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>?B1662 x2 x1 x2a\<rbrace>
 3. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1661 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. valid_option_prio p_auth \<and> True\<rbrace>, -
 4. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ?P1661 x xa xb s \<and> ?P'1661 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 9. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 10. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P1661 x2 x1 x2a\<rbrace> getThreadBufferSlot a \<lbrace>\<lambda>a b. (invs' and sch_act_simple and K True) b \<and> (\<not> x2a \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) b \<and> is_aligned x1 msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. x2a = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) b \<and> is_aligned x1 msg_align_bits \<and> valid_cap' x b \<and> (invs' and sch_act_simple and K True) b \<and> is_aligned x1 msg_align_bits) \<and> (\<not> x2a \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) b \<and> is_aligned x1 msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. x2a = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) b \<and> is_aligned x1 msg_align_bits \<and> valid_cap' x b \<and> (invs' and sch_act_simple and K True) b \<and> is_aligned x1 msg_align_bits)\<rbrace>
 2. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1661 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. valid_option_prio p_auth \<and> True\<rbrace>, -
 3. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ?P1661 x xa xb s \<and> ?P'1661 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 8. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 9. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 10. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x2 x1 x2a. \<lbrakk>g' = Some x2; x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1661 x2 x1 x2a\<rbrace> do bufferSlot <- getThreadBufferSlot a;
doE y <- cteDelete bufferSlot True;
do y <- threadSet (tcbIPCBuffer_update (\<lambda>_. x1)) a;
y <- case x2a of None \<Rightarrow> return () | Some (newCap, srcSlot) \<Rightarrow> checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot bufferSlot)));
thread <- getCurThread;
liftE (when (thread = a) rescheduleRequired)
od
odE
od \<lbrace>\<lambda>rv s. valid_option_prio p_auth \<and> True\<rbrace>, -
 2. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ((invs' and sch_act_simple and K True) s \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits)) \<and> ?P'1661 x xa xb s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 7. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 8. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 9. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 10. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. True \<and> (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s \<and> True) \<and> (\<forall>x. g = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> (xb = None \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xb xc. x = (xb, xc) \<longrightarrow> (invs and emptyable (a, tcb_cnode_index 4)) s \<and> True \<and> True \<and> K (is_cnode_or_valid_arch xb) s \<and> s \<turnstile> xb \<and> (is_nondevice_page_cap xb \<and> (\<forall>ptr. valid_ipc_buffer_cap xb xa)) \<and> K (is_pt_cap xb \<or> is_pd_cap xb \<longrightarrow> cap_asid xb \<noteq> None) s \<and> cte_wp_at (\<lambda>_. True) xc s \<and> no_cap_to_obj_dr_emp xb s \<and> s \<turnstile> xb \<and> (invs and emptyable (a, tcb_cnode_index 4)) s)) \<and> valid_list s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (valid_sched and simple_sched_action) s \<and> tcb_at a s \<and> tcb_at a s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ((invs' and sch_act_simple and K True) s \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits)) \<and> valid_option_prio p_auth \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 6. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 7. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 8. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 9. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 10. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (10 subgoals):
 1. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s) \<and> (\<forall>aa b. g = Some (aa, b) \<longrightarrow> (b = None \<longrightarrow> invs s) \<and> (\<forall>a ab ba. b = Some (a, ab, ba) \<longrightarrow> invs s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> is_nondevice_page_cap a \<and> valid_ipc_buffer_cap a aa \<and> (is_pt_cap a \<longrightarrow> (\<exists>y. cap_asid a = Some y)) \<and> (is_pd_cap a \<longrightarrow> (\<exists>y. cap_asid a = Some y)) \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp a s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ((invs' and sch_act_simple and K True) s \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits)) \<and> valid_option_prio p_auth \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 6. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 7. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 8. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 9. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 10. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (11 subgoals):
 1. \<And>rv s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)) s \<Longrightarrow> (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s) \<and> (\<forall>aa b. g = Some (aa, b) \<longrightarrow> (b = None \<longrightarrow> invs s) \<and> (\<forall>a ab ba. b = Some (a, ab, ba) \<longrightarrow> invs s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> is_nondevice_page_cap a \<and> valid_ipc_buffer_cap a aa \<and> (is_pt_cap a \<longrightarrow> (\<exists>y. cap_asid a = Some y)) \<and> (is_pd_cap a \<longrightarrow> (\<exists>y. cap_asid a = Some y)) \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp a s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s))) s
 2. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>_. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ((invs' and sch_act_simple and K True) s \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits)) \<and> valid_option_prio p_auth \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 7. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 8. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 9. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 10. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)) s \<Longrightarrow> (einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>x\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> insert (slot, cap.NullCap) (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits) and (\<lambda>s. (g = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> tcb_at a s) \<and> (\<forall>aa b. g = Some (aa, b) \<longrightarrow> (b = None \<longrightarrow> invs s) \<and> (\<forall>a ab ba. b = Some (a, ab, ba) \<longrightarrow> invs s \<and> is_cnode_or_valid_arch a \<and> s \<turnstile> a \<and> is_nondevice_page_cap a \<and> valid_ipc_buffer_cap a aa \<and> (is_pt_cap a \<longrightarrow> (\<exists>y. cap_asid a = Some y)) \<and> (is_pd_cap a \<longrightarrow> (\<exists>y. cap_asid a = Some y)) \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> no_cap_to_obj_dr_emp a s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s))) s
 2. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>_. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ((invs' and sch_act_simple and K True) s \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits)) \<and> valid_option_prio p_auth \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 7. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 8. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 9. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 10. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s aa ac bb ab. \<lbrakk>g = Some (aa, Some (cap.ArchObjectCap ab, ac, bb)); invs s; valid_list s; valid_sched s; simple_sched_action s; tcb_at a s; cte_wp_at (\<lambda>_. True) slot s; no_cap_to_obj_dr_emp cap.NullCap s; cte_wp_at (\<lambda>_. True) (ac, bb) s; valid_ipc_buffer_cap (cap.ArchObjectCap ab) aa; is_aligned aa msg_align_bits; no_cap_to_obj_dr_emp (cap.ArchObjectCap ab) s; s \<turnstile> cap.ArchObjectCap ab; (\<exists>p asid. ab = arch_cap.PageTableCap p asid) \<longrightarrow> (\<exists>y. (case ab of arch_cap.PageCap dev obj_ref rights sz None \<Rightarrow> None | arch_cap.PageCap dev obj_ref rights sz (Some (asid, xd)) \<Rightarrow> Some asid | arch_cap.PageTableCap obj_ref None \<Rightarrow> None | arch_cap.PageTableCap obj_ref (Some (asid, xaa)) \<Rightarrow> Some asid | arch_cap.PageDirectoryCap obj_ref None \<Rightarrow> None | arch_cap.PageDirectoryCap obj_ref (Some xa) \<Rightarrow> Some xa | _ \<Rightarrow> None) = Some y); (\<exists>p asid. ab = arch_cap.PageDirectoryCap p asid) \<longrightarrow> (\<exists>y. (case ab of arch_cap.PageCap dev obj_ref rights sz None \<Rightarrow> None | arch_cap.PageCap dev obj_ref rights sz (Some (asid, xd)) \<Rightarrow> Some asid | arch_cap.PageTableCap obj_ref None \<Rightarrow> None | arch_cap.PageTableCap obj_ref (Some (asid, xaa)) \<Rightarrow> Some asid | arch_cap.PageDirectoryCap obj_ref None \<Rightarrow> None | arch_cap.PageDirectoryCap obj_ref (Some xa) \<Rightarrow> Some xa | _ \<Rightarrow> None) = Some y)\<rbrakk> \<Longrightarrow> is_nondevice_page_cap_arch ab
 2. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>_. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ((invs' and sch_act_simple and K True) s \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits)) \<and> valid_option_prio p_auth \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 7. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 8. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 9. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 10. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s aa ac bb ab. \<lbrakk>g = Some (aa, Some (cap.ArchObjectCap ab, ac, bb)); invs s; valid_list s; valid_sched s; simple_sched_action s; tcb_at a s; cte_wp_at (\<lambda>_. True) slot s; no_cap_to_obj_dr_emp cap.NullCap s; cte_wp_at (\<lambda>_. True) (ac, bb) s; valid_ipc_buffer_cap (cap.ArchObjectCap ab) aa; is_aligned aa msg_align_bits; no_cap_to_obj_dr_emp (cap.ArchObjectCap ab) s; s \<turnstile> cap.ArchObjectCap ab; (\<exists>p asid. ab = arch_cap.PageTableCap p asid) \<longrightarrow> (\<exists>y. (case ab of arch_cap.PageCap dev obj_ref rights sz None \<Rightarrow> None | arch_cap.PageCap dev obj_ref rights sz (Some (asid, xd)) \<Rightarrow> Some asid | arch_cap.PageTableCap obj_ref None \<Rightarrow> None | arch_cap.PageTableCap obj_ref (Some (asid, xaa)) \<Rightarrow> Some asid | arch_cap.PageDirectoryCap obj_ref None \<Rightarrow> None | arch_cap.PageDirectoryCap obj_ref (Some xa) \<Rightarrow> Some xa | _ \<Rightarrow> None) = Some y); (\<exists>p asid. ab = arch_cap.PageDirectoryCap p asid) \<longrightarrow> (\<exists>y. (case ab of arch_cap.PageCap dev obj_ref rights sz None \<Rightarrow> None | arch_cap.PageCap dev obj_ref rights sz (Some (asid, xd)) \<Rightarrow> Some asid | arch_cap.PageTableCap obj_ref None \<Rightarrow> None | arch_cap.PageTableCap obj_ref (Some (asid, xaa)) \<Rightarrow> Some asid | arch_cap.PageDirectoryCap obj_ref None \<Rightarrow> None | arch_cap.PageDirectoryCap obj_ref (Some xa) \<Rightarrow> Some xa | _ \<Rightarrow> None) = Some y)\<rbrakk> \<Longrightarrow> is_nondevice_page_cap_arch ab
 2. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>_. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ((invs' and sch_act_simple and K True) s \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits)) \<and> valid_option_prio p_auth \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 7. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 8. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 9. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 10. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>_. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ((invs' and sch_act_simple and K True) s \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits)) \<and> valid_option_prio p_auth \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 6. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 7. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 8. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 9. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 10. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (10 subgoals):
 1. \<lbrace>?Q77\<rbrace> case f of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index (Suc 0));
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index (Suc 0)))))
odE \<lbrace>\<lambda>_. einvs and simple_sched_action and tcb_at a and (\<lambda>s. \<forall>(sl, c)\<in>case g of None \<Rightarrow> {} | Some (x, v) \<Rightarrow> {(slot, cap.NullCap)} \<union> (case v of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}). cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and K (case g of None \<Rightarrow> True | Some (x, None) \<Rightarrow> True | Some (x, Some (c, sl)) \<Rightarrow> is_cnode_or_valid_arch c \<and> is_arch_cap c \<and> valid_ipc_buffer_cap c x \<and> is_aligned x msg_align_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ((invs' and sch_act_simple and K True) s \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits)) \<and> valid_option_prio p_auth \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 6. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 7. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 8. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 9. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 10. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (9 subgoals):
 1. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. True \<and> (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth \<and> True) \<and> (\<forall>x. g' = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> ((invs' and sch_act_simple and K True) s \<and> (xb = None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> tcb_at' a s \<and> True \<and> valid_cap' x s \<and> capBadge x = None \<and> True \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x)) \<and> (tcb_at' a s \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s)) \<and> (xb = None \<longrightarrow> tcb_at' a s) \<and> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> tcb_at' a s))) \<and> ((invs' and sch_act_simple and K True) s \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<not> xb \<noteq> None \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits) \<and> (\<forall>x. \<not> (\<nexists>b. xb = Some (x, b)) \<longrightarrow> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits \<and> valid_cap' x s \<and> (invs' and sch_act_simple and K True) s \<and> is_aligned xa msg_align_bits)) \<and> valid_option_prio p_auth \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and (\<lambda>s. True \<and> (f = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>x\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>x. f = Some x \<longrightarrow> True \<and> (invs and emptyable (a, tcb_cnode_index (Suc 0))) s \<and> True \<and> K (is_cnode_or_valid_arch (fst x)) s \<and> s \<turnstile> fst x \<and> ((case tcb_cap_cases (tcb_cnode_index (Suc 0)) of None \<Rightarrow> True | Some (getF, setF, restr) \<Rightarrow> \<forall>st. restr a st (fst x)) \<and> (tcb_cnode_index (Suc 0) = tcb_cnode_index 4 \<longrightarrow> (\<forall>ptr. valid_ipc_buffer_cap (fst x) ptr))) \<and> (is_pt_cap (fst x) \<longrightarrow> (\<exists>y. cap_asid (fst x) = Some y)) \<and> (is_pd_cap (fst x) \<longrightarrow> (\<exists>y. cap_asid (fst x) = Some y)) \<and> cte_wp_at (\<lambda>_. True) (snd x) s \<and> no_cap_to_obj_dr_emp (fst x) s \<and> s \<turnstile> fst x \<and> (invs and emptyable (a, tcb_cnode_index (Suc 0))) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp (fst x) s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 5. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 6. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 7. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 8. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 9. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (9 subgoals):
 1. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth) \<and> (\<forall>aa b. g' = Some (aa, b) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> (b = None \<longrightarrow> is_aligned aa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>ba. b = Some (x, ba)) \<longrightarrow> is_aligned aa msg_align_bits \<and> tcb_at' a s \<and> valid_cap' x s \<and> capBadge x = None \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x) \<and> tcb_at' a s \<and> valid_option_prio p_auth))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and (\<lambda>s. True \<and> (f = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>x\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>x. f = Some x \<longrightarrow> True \<and> (invs and emptyable (a, tcb_cnode_index (Suc 0))) s \<and> True \<and> K (is_cnode_or_valid_arch (fst x)) s \<and> s \<turnstile> fst x \<and> ((case tcb_cap_cases (tcb_cnode_index (Suc 0)) of None \<Rightarrow> True | Some (getF, setF, restr) \<Rightarrow> \<forall>st. restr a st (fst x)) \<and> (tcb_cnode_index (Suc 0) = tcb_cnode_index 4 \<longrightarrow> (\<forall>ptr. valid_ipc_buffer_cap (fst x) ptr))) \<and> (is_pt_cap (fst x) \<longrightarrow> (\<exists>y. cap_asid (fst x) = Some y)) \<and> (is_pd_cap (fst x) \<longrightarrow> (\<exists>y. cap_asid (fst x) = Some y)) \<and> cte_wp_at (\<lambda>_. True) (snd x) s \<and> no_cap_to_obj_dr_emp (fst x) s \<and> s \<turnstile> fst x \<and> (invs and emptyable (a, tcb_cnode_index (Suc 0))) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp (fst x) s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 5. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 6. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 7. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 8. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 9. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (10 subgoals):
 1. \<And>rv s. (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. valid_option_prio p_auth)) s \<Longrightarrow> (invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and (\<lambda>y. case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. (g' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_option_prio p_auth) \<and> (\<forall>aa b. g' = Some (aa, b) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> (b = None \<longrightarrow> is_aligned aa msg_align_bits \<and> tcb_at' a s) \<and> (\<forall>x. (\<exists>ba. b = Some (x, ba)) \<longrightarrow> is_aligned aa msg_align_bits \<and> tcb_at' a s \<and> valid_cap' x s \<and> capBadge x = None \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x) \<and> tcb_at' a s \<and> valid_option_prio p_auth))) s
 2. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>_. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. valid_option_prio p_auth)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and (\<lambda>s. True \<and> (f = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>x\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>x. f = Some x \<longrightarrow> True \<and> (invs and emptyable (a, tcb_cnode_index (Suc 0))) s \<and> True \<and> K (is_cnode_or_valid_arch (fst x)) s \<and> s \<turnstile> fst x \<and> ((case tcb_cap_cases (tcb_cnode_index (Suc 0)) of None \<Rightarrow> True | Some (getF, setF, restr) \<Rightarrow> \<forall>st. restr a st (fst x)) \<and> (tcb_cnode_index (Suc 0) = tcb_cnode_index 4 \<longrightarrow> (\<forall>ptr. valid_ipc_buffer_cap (fst x) ptr))) \<and> (is_pt_cap (fst x) \<longrightarrow> (\<exists>y. cap_asid (fst x) = Some y)) \<and> (is_pd_cap (fst x) \<longrightarrow> (\<exists>y. cap_asid (fst x) = Some y)) \<and> cte_wp_at (\<lambda>_. True) (snd x) s \<and> no_cap_to_obj_dr_emp (fst x) s \<and> s \<turnstile> fst x \<and> (invs and emptyable (a, tcb_cnode_index (Suc 0))) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp (fst x) s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 6. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 7. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 8. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 9. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 10. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (9 subgoals):
 1. \<lbrace>?Q'77\<rbrace> case f' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadVSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>_. invs' and sch_act_simple and tcb_at' a and (\<lambda>s. \<forall>cp\<in>case g' of None \<Rightarrow> {} | Some (x, None) \<Rightarrow> {} | Some (x, Some (c, sl)) \<Rightarrow> {c}. valid_cap' cp s) and K (case g' of None \<Rightarrow> True | Some (x, v) \<Rightarrow> is_aligned x msg_align_bits \<and> (case v of None \<Rightarrow> True | Some (ac, x) \<Rightarrow> isArchObjectCap ac)) and (\<lambda>s. valid_option_prio p_auth)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?Q65\<rbrace> case e of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (a, tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (cap.ThreadCap a) slot (cap_insert new_cap src_slot (a, tcb_cnode_index 0))))
odE \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) and emptyable (a, tcb_cnode_index (Suc 0)) and (\<lambda>s. \<forall>x\<in>case f of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case f of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and (\<lambda>s. True \<and> (f = None \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>x\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>x. f = Some x \<longrightarrow> True \<and> (invs and emptyable (a, tcb_cnode_index (Suc 0))) s \<and> True \<and> K (is_cnode_or_valid_arch (fst x)) s \<and> s \<turnstile> fst x \<and> ((case tcb_cap_cases (tcb_cnode_index (Suc 0)) of None \<Rightarrow> True | Some (getF, setF, restr) \<Rightarrow> \<forall>st. restr a st (fst x)) \<and> (tcb_cnode_index (Suc 0) = tcb_cnode_index 4 \<longrightarrow> (\<forall>ptr. valid_ipc_buffer_cap (fst x) ptr))) \<and> (is_pt_cap (fst x) \<longrightarrow> (\<exists>y. cap_asid (fst x) = Some y)) \<and> (is_pd_cap (fst x) \<longrightarrow> (\<exists>y. cap_asid (fst x) = Some y)) \<and> cte_wp_at (\<lambda>_. True) (snd x) s \<and> no_cap_to_obj_dr_emp (fst x) s \<and> s \<turnstile> fst x \<and> (invs and emptyable (a, tcb_cnode_index (Suc 0))) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> simple_sched_action s \<and> tcb_at a s \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp (fst x) s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'65\<rbrace> case e' of None \<Rightarrow> returnOk () | Some (newCap, srcSlot) \<Rightarrow> do rootSlot <- getThreadCSpaceRoot a;
doE y <- cteDelete rootSlot True;
liftE (checkCapAt newCap srcSlot (checkCapAt (capability.ThreadCap a) sl' (assertDerived srcSlot newCap (cteInsert newCap srcSlot rootSlot))))
odE
od \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) and (\<lambda>s. \<forall>cp\<in>case f' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'77\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some (mcp, auth) \<Rightarrow> set_mcpriority a mcp \<lbrace>\<lambda>x. einvs and simple_sched_action and cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) and emptyable (a, tcb_cnode_index 0) and (\<lambda>s. \<forall>x\<in>case e of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {(sl, c), (slot, c)}. case x of (sl, c) \<Rightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_dr_emp c s \<and> s \<turnstile> c) and (\<lambda>y. case e of None \<Rightarrow> True | Some (c, sl) \<Rightarrow> is_cnode_or_valid_arch c) and ?Q65\<rbrace>
 5. \<lbrace>?Q'55\<rbrace> case mcp_auth of None \<Rightarrow> return () | Some x2 \<Rightarrow> setMCPriority a (fst x2) \<lbrace>\<lambda>x. invs' and sch_act_simple and cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) and (\<lambda>s. \<forall>cp\<in>case e' of None \<Rightarrow> {} | Some (c, sl) \<Rightarrow> {c}. valid_cap' cp s) and ?Q'65\<rbrace>
 6. \<lbrace>?Q50\<rbrace> option_update_thread a (tcb_fault_handler_update \<circ> (\<lambda>x y. x)) (map_option to_bl b') \<lbrace>\<lambda>x. tcb_at a and ?Q55\<rbrace>
 7. \<lbrace>?Q'50\<rbrace> case b' of None \<Rightarrow> return () | Some x \<Rightarrow> threadSet (tcbFaultHandler_update (\<lambda>y. x)) a \<lbrace>\<lambda>x. tcb_at' a and ?Q'55\<rbrace>
 8. \<And>s. (einvs and simple_sched_action and tcb_at a and (\<lambda>s. ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (\<lambda>y. case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) and (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) and (\<lambda>y. case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) s \<Longrightarrow> (tcb_at a and ?Q50) s
 9. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and ?Q'50) s proof (prove)
goal (2 subgoals):
 1. \<And>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) s \<and> (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) s \<and> (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) s \<and> (case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) \<and> (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) s \<and> (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) s \<and> (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) s \<and> (case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) \<and> (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) s \<and> (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) s \<and> (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) s \<and> (case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) \<and> (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> mcpriority_tcb_at ((\<le>) (fst x2)) (snd x2) s) \<and> (case mcp_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> mcpriority_tcb_at ((\<le>) (fst x2)) (snd x2) s) \<Longrightarrow> (mcp_auth = None \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) s \<and> (\<forall>x\<in>case e of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (e = None \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) s \<and> (\<forall>x\<in>case f of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (f = None \<longrightarrow> (\<forall>x\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>x xa xb. f = Some (x, xa, xb) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_valid_vtable_root x \<or> cap.NullCap = x) \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits))) \<and> (\<forall>x xa xb. e = Some (x, xa, xb) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) s \<and> (\<forall>xa\<in>case f of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (f = None \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>xc xd xe. f = Some (xc, xd, xe) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> is_cnode_or_valid_arch xc \<and> s \<turnstile> xc \<and> (is_valid_vtable_root xc \<or> cap.NullCap = xc) \<and> (is_pt_cap xc \<longrightarrow> (\<exists>y. cap_asid xc = Some y)) \<and> (is_pd_cap xc \<longrightarrow> (\<exists>y. cap_asid xc = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xd, xe) s \<and> no_cap_to_obj_dr_emp xc s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> xc \<and> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> no_cap_to_obj_dr_emp xc s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)))) \<and> ((\<exists>a b. mcp_auth = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) s \<and> (\<forall>x\<in>case e of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (e = None \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) s \<and> (\<forall>x\<in>case f of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (f = None \<longrightarrow> (\<forall>x\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>x xa xb. f = Some (x, xa, xb) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_valid_vtable_root x \<or> cap.NullCap = x) \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits))) \<and> (\<forall>x xa xb. e = Some (x, xa, xb) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) s \<and> (\<forall>xa\<in>case f of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (f = None \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>xc xd xe. f = Some (xc, xd, xe) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> is_cnode_or_valid_arch xc \<and> s \<turnstile> xc \<and> (is_valid_vtable_root xc \<or> cap.NullCap = xc) \<and> (is_pt_cap xc \<longrightarrow> (\<exists>y. cap_asid xc = Some y)) \<and> (is_pd_cap xc \<longrightarrow> (\<exists>y. cap_asid xc = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xd, xe) s \<and> no_cap_to_obj_dr_emp xc s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> xc \<and> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> no_cap_to_obj_dr_emp xc s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits))))
 2. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and (\<lambda>s. (b' = None \<longrightarrow> tcb_at' a s \<and> (mcp_auth = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>cp\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' cp s) \<and> (e' = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>cp\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' cp s) \<and> (f' = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>aa. (\<exists>b. f' = Some (aa, b)) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>aa. (\<exists>b. e' = Some (aa, b)) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>x. (\<exists>b. f' = Some (x, b)) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)))) \<and> (\<forall>aa. (\<exists>b. mcp_auth = Some (aa, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>x\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (e' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>x. (\<exists>b. f' = Some (x, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>x. (\<exists>b. e' = Some (x, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xa. (\<exists>b. f' = Some (xa, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))))) \<and> (\<forall>x. b' = Some x \<longrightarrow> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (mcp_auth = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>x\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (e' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>x. (\<exists>b. f' = Some (x, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>x. (\<exists>b. e' = Some (x, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xa. (\<exists>b. f' = Some (xa, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)))) \<and> (\<forall>x. (\<exists>b. mcp_auth = Some (x, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>x\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (e' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xa. (\<exists>b. f' = Some (xa, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>xa. (\<exists>b. e' = Some (xa, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xb. (\<exists>b. f' = Some (xb, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xb s \<and> capBadge xb = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xb \<and> \<not> isIRQControlCap xb \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))))))) s proof (prove)
goal (2 subgoals):
 1. \<And>s. invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> tcb_at a s \<and> ((\<exists>a aa b. e = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a aa b. f = Some (a, aa, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> ((\<exists>a b. g = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) \<and> (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) s \<and> (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) s \<and> (case e of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) s \<and> (case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_cap (fst x2)) \<and> (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) s \<and> (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) s \<and> (case f of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) s \<and> (case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_valid_vtable_root (fst x2)) \<and> (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> cte_wp_at (\<lambda>_. True) (snd x2)) s \<and> (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> no_cap_to_obj_dr_emp (fst x2)) s \<and> (case g of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap (fst x2)) s \<and> (case g of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) \<and> (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_ipc_buffer_cap (fst x2) (fst v) \<and> is_arch_cap (fst x2) \<and> is_cnode_or_valid_arch (fst x2)) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> mcpriority_tcb_at ((\<le>) (fst x2)) (snd x2) s) \<and> (case mcp_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> mcpriority_tcb_at ((\<le>) (fst x2)) (snd x2) s) \<Longrightarrow> (mcp_auth = None \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) s \<and> (\<forall>x\<in>case e of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (e = None \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) s \<and> (\<forall>x\<in>case f of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (f = None \<longrightarrow> (\<forall>x\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>x xa xb. f = Some (x, xa, xb) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_valid_vtable_root x \<or> cap.NullCap = x) \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits))) \<and> (\<forall>x xa xb. e = Some (x, xa, xb) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) s \<and> (\<forall>xa\<in>case f of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (f = None \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>xc xd xe. f = Some (xc, xd, xe) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> is_cnode_or_valid_arch xc \<and> s \<turnstile> xc \<and> (is_valid_vtable_root xc \<or> cap.NullCap = xc) \<and> (is_pt_cap xc \<longrightarrow> (\<exists>y. cap_asid xc = Some y)) \<and> (is_pd_cap xc \<longrightarrow> (\<exists>y. cap_asid xc = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xd, xe) s \<and> no_cap_to_obj_dr_emp xc s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> xc \<and> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> no_cap_to_obj_dr_emp xc s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)))) \<and> ((\<exists>a b. mcp_auth = Some (a, b)) \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index 0) s \<and> (\<forall>x\<in>case e of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case e of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (e = None \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) s \<and> (\<forall>x\<in>case f of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (f = None \<longrightarrow> (\<forall>x\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst x) s \<and> no_cap_to_obj_dr_emp (snd x) s \<and> s \<turnstile> snd x) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>x xa xb. f = Some (x, xa, xb) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_valid_vtable_root x \<or> cap.NullCap = x) \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits))) \<and> (\<forall>x xa xb. e = Some (x, xa, xb) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> cte_wp_at (\<lambda>_. True) (a, tcb_cnode_index (Suc 0)) s \<and> (\<forall>xa\<in>case f of None \<Rightarrow> {} | Some x2 \<Rightarrow> {(snd x2, fst x2), (slot, fst x2)}. cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case f of None \<Rightarrow> True | Some x2 \<Rightarrow> is_cnode_or_valid_arch (fst x2)) \<and> (f = None \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits)) \<and> (\<forall>xc xd xe. f = Some (xc, xd, xe) \<longrightarrow> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> is_cnode_or_valid_arch xc \<and> s \<turnstile> xc \<and> (is_valid_vtable_root xc \<or> cap.NullCap = xc) \<and> (is_pt_cap xc \<longrightarrow> (\<exists>y. cap_asid xc = Some y)) \<and> (is_pd_cap xc \<longrightarrow> (\<exists>y. cap_asid xc = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xd, xe) s \<and> no_cap_to_obj_dr_emp xc s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> xc \<and> is_cnode_or_valid_arch x \<and> s \<turnstile> x \<and> (is_pt_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> (is_pd_cap x \<longrightarrow> (\<exists>y. cap_asid x = Some y)) \<and> cte_wp_at (\<lambda>_. True) (xa, xb) s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> x \<and> (\<forall>xa\<in>case g of None \<Rightarrow> {} | Some a \<Rightarrow> insert (slot, cap.NullCap) (case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {(snd a, fst a), (slot, fst a)}). cte_wp_at (\<lambda>_. True) (fst xa) s \<and> no_cap_to_obj_dr_emp (snd xa) s \<and> no_cap_to_obj_dr_emp x s \<and> no_cap_to_obj_dr_emp xc s \<and> no_cap_to_obj_dr_emp x s \<and> s \<turnstile> snd xa) \<and> (case g of None \<Rightarrow> True | Some a \<Rightarrow> case snd a of None \<Rightarrow> True | Some aa \<Rightarrow> is_cnode_or_valid_arch (fst aa) \<and> is_arch_cap (fst aa) \<and> valid_ipc_buffer_cap (fst aa) (fst a) \<and> is_aligned (fst a) msg_align_bits))))
 2. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and (\<lambda>s. (b' = None \<longrightarrow> tcb_at' a s \<and> (mcp_auth = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>cp\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' cp s) \<and> (e' = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>cp\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' cp s) \<and> (f' = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>aa. (\<exists>b. f' = Some (aa, b)) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>aa. (\<exists>b. e' = Some (aa, b)) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>x. (\<exists>b. f' = Some (x, b)) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)))) \<and> (\<forall>aa. (\<exists>b. mcp_auth = Some (aa, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>x\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (e' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>x. (\<exists>b. f' = Some (x, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>x. (\<exists>b. e' = Some (x, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xa. (\<exists>b. f' = Some (xa, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))))) \<and> (\<forall>x. b' = Some x \<longrightarrow> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (mcp_auth = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>x\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (e' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>x. (\<exists>b. f' = Some (x, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>x. (\<exists>b. e' = Some (x, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xa. (\<exists>b. f' = Some (xa, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)))) \<and> (\<forall>x. (\<exists>b. mcp_auth = Some (x, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>x\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (e' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xa. (\<exists>b. f' = Some (xa, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>xa. (\<exists>b. e' = Some (xa, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xb. (\<exists>b. f' = Some (xb, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xb s \<and> capBadge xb = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xb \<and> \<not> isIRQControlCap xb \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))))))) s proof (prove)
goal (1 subgoal):
 1. \<And>s. (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>s. ((\<exists>a b. e' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. f' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) \<and> ((\<exists>a b. g' = Some (a, b)) \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) and (\<lambda>y. case e' of None \<Rightarrow> True | Some x2 \<Rightarrow> isCNodeCap (fst x2)) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and (\<lambda>y. case f' of None \<Rightarrow> True | Some x2 \<Rightarrow> isValidVTableRoot (fst x2)) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> is_aligned (fst x2) msg_align_bits) and (\<lambda>y. case g' of None \<Rightarrow> True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> True | Some x2 \<Rightarrow> isArchObjectCap (fst x2)) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> case snd x2 of None \<Rightarrow> \<lambda>_. True | Some x2 \<Rightarrow> valid_cap' (fst x2)) and tcb_at' a and ex_nonz_cap_to' a and (\<lambda>y. valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) s \<Longrightarrow> (tcb_at' a and (\<lambda>s. (b' = None \<longrightarrow> tcb_at' a s \<and> (mcp_auth = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>cp\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' cp s) \<and> (e' = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>cp\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' cp s) \<and> (f' = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>cp\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' cp s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>aa. (\<exists>b. f' = Some (aa, b)) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>aa. (\<exists>b. e' = Some (aa, b)) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>x. (\<exists>b. f' = Some (x, b)) \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> sch_act_simple s \<and> valid_cap' aa s \<and> capBadge aa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap aa \<and> \<not> isIRQControlCap aa \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)))) \<and> (\<forall>aa. (\<exists>b. mcp_auth = Some (aa, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>x\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (e' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>x. (\<exists>b. f' = Some (x, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>x. (\<exists>b. e' = Some (x, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xa. (\<exists>b. f' = Some (xa, b)) \<longrightarrow> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> invs' s \<and> tcb_at' a s \<and> aa \<le> maxPriority \<and> sch_act_simple s \<and> tcb_at' a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))))) \<and> (\<forall>x. b' = Some x \<longrightarrow> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (mcp_auth = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>x\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (e' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>x. (\<exists>b. f' = Some (x, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>x. (\<exists>b. e' = Some (x, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xa. (\<exists>b. f' = Some (xa, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> valid_cap' x s \<and> capBadge x = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap x \<and> \<not> isIRQControlCap x \<and> (invs' and tcb_at' a) s \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)))) \<and> (\<forall>x. (\<exists>b. mcp_auth = Some (x, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index 0)) s \<and> (\<forall>x\<in>case e' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (e' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xa. (\<exists>b. f' = Some (xa, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))) \<and> (\<forall>xa. (\<exists>b. e' = Some (xa, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, tcb_cnode_index (Suc 0))) s \<and> (\<forall>x\<in>case f' of None \<Rightarrow> {} | Some x2 \<Rightarrow> {fst x2}. valid_cap' x s) \<and> (f' = None \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority)) \<and> (\<forall>xb. (\<exists>b. f' = Some (xb, b)) \<longrightarrow> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xb s \<and> capBadge xb = None \<and> cte_map (a, tcb_cnode_index (Suc 0)) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xb \<and> \<not> isIRQControlCap xb \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> valid_cap' xa s \<and> capBadge xa = None \<and> cte_map (a, tcb_cnode_index 0) \<in> (+) a ` dom tcb_cte_cases \<and> \<not> isReplyCap xa \<and> \<not> isIRQControlCap xa \<and> (invs' and tcb_at' a) s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> x \<le> maxPriority \<and> sch_act_simple s \<and> obj_at' (\<lambda>obj. if a = a then True else True) a s \<and> (\<forall>x\<in>case g' of None \<Rightarrow> {} | Some a \<Rightarrow> case snd a of None \<Rightarrow> {} | Some a \<Rightarrow> {fst a}. valid_cap' x s) \<and> (case g' of None \<Rightarrow> True | Some a \<Rightarrow> is_aligned (fst a) msg_align_bits \<and> (case snd a of None \<Rightarrow> True | Some a \<Rightarrow> isArchObjectCap (fst a))) \<and> (case p_auth of None \<Rightarrow> True | Some x2 \<Rightarrow> fst x2 \<le> maxPriority))))))) s proof (state)
this:
corres (dc \<oplus> (=)) (einvs and simple_sched_action and tcb_at a and (\<lambda>s. {e, f, map_option undefined g} \<noteq> {None} \<longrightarrow> cte_wp_at (\<lambda>_. True) slot s) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case e of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case e of None \<Rightarrow> True | Some x \<Rightarrow> (is_cnode_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case f of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x) and K (case f of None \<Rightarrow> True | Some x \<Rightarrow> (is_valid_vtable_root \<circ> fst) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) \<circ> snd) x) and (case g of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap \<circ> fst) \<circ> snd) x) and K (case g of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g of None \<Rightarrow> True | Some v \<Rightarrow> case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and is_cnode_or_valid_arch) \<circ> fst) x) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (mcp, auth) \<Rightarrow> mcpriority_tcb_at ((\<le>) mcp) auth s)) (invs' and sch_act_simple and (case e' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and (\<lambda>s. {e', f', map_option undefined g'} \<noteq> {None} \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s) and K (case e' of None \<Rightarrow> True | Some x \<Rightarrow> (isCNodeCap \<circ> fst) x) and (case f' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap' \<circ> fst) x) and K (case f' of None \<Rightarrow> True | Some x \<Rightarrow> (isValidVTableRoot \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> ((\<lambda>v. is_aligned v msg_align_bits) \<circ> fst) x) and K (case g' of None \<Rightarrow> True | Some x \<Rightarrow> (case_option True (isArchObjectCap \<circ> fst) \<circ> snd) x) and (case g' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (valid_cap' \<circ> fst) \<circ> snd) x) and tcb_at' a and ex_nonz_cap_to' a and K (valid_option_prio p_auth \<and> valid_option_prio mcp_auth) and (\<lambda>s. case p_auth of None \<Rightarrow> True | Some (pr, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) pr) auth s) and (\<lambda>s. case mcp_auth of None \<Rightarrow> True | Some (m, auth) \<Rightarrow> mcpriority_tcb_at' ((\<le>) m) auth s)) (invoke_tcb (tcb_invocation.ThreadControl a slot (map_option to_bl b') mcp_auth p_auth e f g)) (invokeTCB (tcbinvocation.ThreadControl a sl' b' mcp_auth p_auth e' f' g'))

goal:
No subgoals!