theory Tcb_DR

lemma dcorres_tcb_update_cspace_root:
  "dcorres (dc \<oplus> dc) (\<top> ) ( invs and valid_etcbs and valid_pdpt_objs
           and not_idle_thread obj_id' and tcb_at obj_id' and
           case_option (\<lambda>_. True) (valid_cap \<circ> fst) croot' and
      (\<lambda>y. case_option True (\<lambda>x. not_idle_thread (fst a') y) croot') and
      (\<lambda>y. case_option True (Structures_A.is_cnode_cap \<circ> fst) croot') and
           case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd ) croot' and
           case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) croot' and
           case_option (\<lambda>_. True) (no_cap_to_obj_dr_emp \<circ> fst) croot')
    (case_option (returnOk ()) (tcb_update_cspace_root obj_id' (transform_cslot_ptr a'))
        (map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot'))
    (case_option (returnOk ())
        (case_prod
        (\<lambda>new_cap src_slot.
          doE cap_delete (obj_id', tcb_cnode_index 0);
            liftE $
            check_cap_at new_cap src_slot $
            check_cap_at (cap.ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
          odE))
      croot')" apply (case_tac croot') apply simp_all apply (rule corres_guard_imp[OF dcorres_returnOk],simp+) apply (case_tac a) apply (clarsimp simp:tcb_update_cspace_root_def tcb_update_thread_slot_def) apply (simp add:transform_tcb_slot_simp[symmetric]) apply (rule dcorres_expand_pfx) apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule dcorres_tcb_empty_slot) apply (simp add:transform_tcb_slot_0) apply (simp add:check_cap_at_def liftE_bindE) apply (clarsimp simp:no_cap_to_obj_with_diff_ref_def) apply (clarsimp simp:whenE_liftE bind_assoc same_object_as_def) apply (clarsimp simp:liftE_def bind_assoc) apply (rule corres_split) apply (rule get_cap_corres; simp) apply (rule_tac F = "(is_cnode_cap x \<and> obj_refs x = obj_refs aaa) \<longrightarrow> (bits_of x = bits_of aaa)"
                in corres_gen_asm2) apply (rule corres_split) apply (rule corres_when) apply (rule iffI) apply (clarsimp simp:is_cap_simps bits_of_def cap_type_def transform_cap_def
               split:cap.split_asm arch_cap.split_asm if_split_asm) apply (clarsimp simp:cap_has_object_def is_cap_simps cap_type_def) apply (rule corres_split) apply (rule get_cap_corres; simp) apply (rule corres_when) apply (rule sym) apply (simp add:table_cap_ref_def) apply (case_tac rv') 
    (* Following line is incredibly brittle. You may need to change the number if the proof breaks *)
                          apply ((clarsimp simp:transform_cap_def split: arch_cap.splits)+)[12] apply (simp) apply (rule dcorres_insert_cap_combine[folded alternative_com]) apply (clarsimp simp:is_cap_simps) apply wp apply (rule_tac Q = "\<lambda>r s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s
             \<and>  valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s
             \<and> ((is_thread_cap r \<and> obj_ref_of r = obj_id') \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (obj_id', tcb_cnode_index 0) s)"
             in hoare_strengthen_post) apply (wp get_cap_ex_cte_cap_wp_to) apply (clarsimp+)[2] apply (drule (3) ex_cte_cap_to_not_idle, simp add: not_idle_thread_def) apply (erule valid_cap_aligned) apply (rule corres_trivial) apply (clarsimp) apply (wp when_wp) apply (rule hoare_strengthen_post[OF hoare_TrueI[where P =\<top> ]]) apply clarsimp apply wp+ apply (rule hoare_vcg_conj_lift) apply (rule hoare_drop_imp) apply wp apply simp apply (rule_tac cnode_cap_unique_bits) apply simp apply clarsimp apply wp apply (clarsimp simp:conj_comms) apply (rule_tac Q = "\<lambda>r s. invs s \<and> valid_etcbs s \<and> not_idle_thread ba s \<and> valid_cap aaa s \<and>
                 not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and>
                 cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and>
                 no_cap_to_obj_dr_emp aaa s"
            in hoare_post_impErr[where E = "\<lambda>r. \<top>"]) apply (simp add:not_idle_thread_def) apply (wp cap_delete_cte_at cap_delete_deletes cap_delete_valid_cap) apply (simp add:invs_valid_objs) apply (clarsimp simp: invs_def valid_state_def no_cap_to_obj_with_diff_ref_def
                           cte_wp_at_def valid_pspace_vo) apply (clarsimp simp:empty_set_eq not_idle_thread_def emptyable_def)+ apply (erule tcb_at_cte_at) apply (simp add:tcb_cap_cases_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x)) (case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x) (case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE) proof (prove)
goal (2 subgoals):
 1. croot' = None \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x)) (case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x) (case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE)
 2. \<And>a. croot' = Some a \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (valid_cap \<circ> fst) x) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') y) and (\<lambda>y. case croot' of None \<Rightarrow> True | Some x \<Rightarrow> (Structures_A.is_cnode_cap \<circ> fst) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case croot' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (no_cap_to_obj_dr_emp \<circ> fst) x)) (case map_option (\<lambda>r. (transform_cap (fst r), transform_cslot_ptr (snd r))) croot' of None \<Rightarrow> returnOk () | Some x \<Rightarrow> tcb_update_cspace_root obj_id' (transform_cslot_ptr a') x) (case croot' of None \<Rightarrow> returnOk () | Some (new_cap, src_slot) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 0);
liftE $ check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0)
odE) proof (prove)
goal (2 subgoals):
 1. croot' = None \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and not_idle_thread obj_id' and tcb_at obj_id') (returnOk ()) (returnOk ())
 2. \<And>a. croot' = Some a \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap (fst a) and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap (fst a)) and not_idle_thread (fst (snd a)) and cte_wp_at (\<lambda>_. True) (snd a) and no_cap_to_obj_dr_emp (fst a)) (tcb_update_cspace_root obj_id' (transform_cslot_ptr a') (transform_cap (fst a), transform_cslot_ptr (snd a))) (case a of (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (obj_id', tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (ThreadCap obj_id') a' (cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0))))
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a. croot' = Some a \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap (fst a) and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap (fst a)) and not_idle_thread (fst (snd a)) and cte_wp_at (\<lambda>_. True) (snd a) and no_cap_to_obj_dr_emp (fst a)) (tcb_update_cspace_root obj_id' (transform_cslot_ptr a') (transform_cap (fst a), transform_cslot_ptr (snd a))) (case a of (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (obj_id', tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (ThreadCap obj_id') a' (cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0))))
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a aa b c. \<lbrakk>croot' = Some a; a = (aa, b, c)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap (fst a) and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap (fst a)) and not_idle_thread (fst (snd a)) and cte_wp_at (\<lambda>_. True) (snd a) and no_cap_to_obj_dr_emp (fst a)) (tcb_update_cspace_root obj_id' (transform_cslot_ptr a') (transform_cap (fst a), transform_cslot_ptr (snd a))) (case a of (new_cap, src_slot) \<Rightarrow> doE y <- cap_delete (obj_id', tcb_cnode_index 0);
liftE (check_cap_at new_cap src_slot (check_cap_at (ThreadCap obj_id') a' (cap_insert new_cap src_slot (obj_id', tcb_cnode_index 0))))
odE) proof (prove)
goal (1 subgoal):
 1. \<And>aaa ba c. croot' = Some (aaa, ba, c) \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) (doE y <- tcb_empty_thread_slot obj_id' tcb_cspace_slot;
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ba, c)));
whenE (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (obj_id', tcb_cspace_slot) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (obj_id', tcb_cspace_slot))
od))
odE) (doE y <- cap_delete (obj_id', tcb_cnode_index 0);
liftE (check_cap_at aaa (ba, c) (check_cap_at (ThreadCap obj_id') a' (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))))
odE) proof (prove)
goal (1 subgoal):
 1. \<And>aaa ba c. croot' = Some (aaa, ba, c) \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) (doE y <- tcb_empty_thread_slot obj_id' tcb_cspace_slot;
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ba, c)));
whenE (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od))
odE) (doE y <- cap_delete (obj_id', tcb_cnode_index 0);
liftE (check_cap_at aaa (ba, c) (check_cap_at (ThreadCap obj_id') a' (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))))
odE) proof (prove)
goal (1 subgoal):
 1. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) s) ((=) s') (doE y <- tcb_empty_thread_slot obj_id' tcb_cspace_slot;
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ba, c)));
whenE (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od))
odE) (doE y <- cap_delete (obj_id', tcb_cnode_index 0);
liftE (check_cap_at aaa (ba, c) (check_cap_at (ThreadCap obj_id') a' (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q18 aaa ba c s s') (?Q'18 aaa ba c s s') (doE y <- tcb_empty_thread_slot obj_id' tcb_cspace_slot;
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ba, c)));
whenE (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od))
odE) (doE y <- cap_delete (obj_id', tcb_cnode_index 0);
liftE (check_cap_at aaa (ba, c) (check_cap_at (ThreadCap obj_id') a' (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))))
odE)
 2. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ?Q18 aaa ba c s s' sa
 3. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> ?Q'18 aaa ba c s s' sa proof (prove)
goal (6 subgoals):
 1. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'22 aaa ba c s s') (?P22 aaa ba c s s') (?P'22 aaa ba c s s') (tcb_empty_thread_slot obj_id' tcb_cspace_slot) (cap_delete (obj_id', tcb_cnode_index 0))
 2. \<And>aaa ba c s s' y ya. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; ?r'22 aaa ba c s s' y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 aaa ba c s s' y) (?R'22 aaa ba c s s' ya) (doE src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ba, c)));
whenE (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od))
odE) (liftE (check_cap_at aaa (ba, c) (check_cap_at (ThreadCap obj_id') a' (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0)))))
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>?R22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>?R'22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> (?P22 aaa ba c s s' and ?Q22 aaa ba c s s') sa
 6. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (?P'22 aaa ba c s s' and ?Q'22 aaa ba c s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> (obj_id', tcb_cspace_slot) = transform_cslot_ptr (obj_id', tcb_cnode_index 0)
 2. \<And>aaa ba c s s' y ya. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 aaa ba c s s' y) (?R'22 aaa ba c s s' ya) (doE src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ba, c)));
whenE (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od))
odE) (liftE (check_cap_at aaa (ba, c) (check_cap_at (ThreadCap obj_id') a' (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0)))))
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>?R22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>?R'22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 6. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s s' y ya. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 aaa ba c s s' y) (?R'22 aaa ba c s s' ya) (doE src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ba, c)));
whenE (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od))
odE) (liftE (check_cap_at aaa (ba, c) (check_cap_at (ThreadCap obj_id') a' (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0)))))
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>?R22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>?R'22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; invs s' \<and> valid_etcbs s' \<and> Ball (ran (kheap s')) obj_valid_pdpt \<and> not_idle_thread obj_id' s' \<and> tcb_at obj_id' s' \<and> s' \<turnstile> aaa \<and> not_idle_thread (fst a') s' \<and> Structures_A.is_cnode_cap aaa \<and> not_idle_thread ba s' \<and> cte_wp_at (\<lambda>_. True) (ba, c) s' \<and> no_cap_to_obj_dr_emp aaa s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 aaa ba c (transform s') s' ()) (?R'22 aaa ba c (transform s') s' ()) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr (ba, c));
whenE (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od))
od) (liftE (do cap' <- CSpaceAcc_A.get_cap (ba, c);
when (same_object_as aaa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od)
od))
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>?R22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>?R'22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 aaa ba c (transform s') s' ()) (?R'22 aaa ba c (transform s') s' ()) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr (ba, c));
whenE (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od))
od) (liftE (do cap' <- CSpaceAcc_A.get_cap (ba, c);
when (same_object_as aaa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od)
od))
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>?R22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>?R'22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 aaa ba c (transform s') s' ()) (?R'22 aaa ba c (transform s') s' ()) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr (ba, c));
liftE (when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od))
od) (liftE (do cap' <- CSpaceAcc_A.get_cap (ba, c);
when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case cap' of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa cap' | ArchObjectCap ac \<Rightarrow> case cap' of ArchObjectCap x \<Rightarrow> same_aobject_as ac x | _ \<Rightarrow> same_region_as aaa cap' | _ \<Rightarrow> same_region_as aaa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od)
od))
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>?R22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>?R'22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 aaa ba c (transform s') s' ()) (?R'22 aaa ba c (transform s') s' ()) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr (ba, c));
r <- when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od);
return (Inr ())
od) (do x <- CSpaceAcc_A.get_cap (ba, c);
r <- when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap x \<Rightarrow> same_aobject_as ac x | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od);
return (Inr ())
od)
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>?R22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>?R'22 aaa ba c s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> dcorres (?r'50 aaa ba c s') (?P58 aaa ba c (transform s') s' ()) (?P'56 aaa ba c (transform s') s' ()) (KHeap_D.get_cap (transform_cslot_ptr (ba, c))) (CSpaceAcc_A.get_cap (ba, c))
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; ?r'50 aaa ba c s' src_cap x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R50 aaa ba c s' src_cap) (?R'50 aaa ba c s' x) (do r <- when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od);
return (Inr ())
od) (do r <- when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od);
return (Inr ())
od)
 3. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>?R50 aaa ba c s'\<rbrace>
 4. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>?R'50 aaa ba c s'\<rbrace>
 5. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. ?P58 aaa ba c s s' a and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. ?P'56 aaa ba c s s' a and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 8. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R50 aaa ba c s' src_cap) (?R'50 aaa ba c s' x) (do r <- when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od);
return (Inr ())
od) (do r <- when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od);
return (Inr ())
od)
 2. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>?R50 aaa ba c s'\<rbrace>
 3. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>?R'50 aaa ba c s'\<rbrace>
 4. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 7. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R50 aaa ba c s' src_cap) (?P'70 aaa ba c s' x) (do r <- when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od);
return (Inr ())
od) (do r <- when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od);
return (Inr ())
od)
 2. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>?R50 aaa ba c s'\<rbrace>
 3. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. ?P'70 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 4. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 7. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> dcorres (?r'71 aaa ba c s' src_cap x) (?P72 aaa ba c s' src_cap) (?P'74 aaa ba c s' x) (when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od)) (when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od))
 2. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; ?r'71 aaa ba c s' src_cap x rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. ?P72 aaa ba c s' src_cap and ?Q73 aaa ba c s' src_cap\<rbrace>
 6. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. ?P'74 aaa ba c s' x and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 7. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 10. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (11 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) = (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x)
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> dcorres dc (?P82 aaa ba c s' src_cap) (?P'84 aaa ba c s' x) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od)
 3. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 6. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ?P82 aaa ba c s' src_cap x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 7. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> ?P'84 aaa ba c s' x xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 8. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)\<rbrakk> \<Longrightarrow> case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x\<rbrakk> \<Longrightarrow> Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> dcorres dc (?P82 aaa ba c s' src_cap) (?P'84 aaa ba c s' x) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od)
 4. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 5. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 6. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 7. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ?P82 aaa ba c s' src_cap x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 8. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> ?P'84 aaa ba c s' x xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 9. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x\<rbrakk> \<Longrightarrow> Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> dcorres dc (?P82 aaa ba c s' src_cap) (?P'84 aaa ba c s' x) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od)
 3. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 6. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ?P82 aaa ba c s' src_cap x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 7. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> ?P'84 aaa ba c s' x xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 8. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> dcorres dc (?P82 aaa ba c s' src_cap) (?P'84 aaa ba c s' x) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od)
 2. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ?P82 aaa ba c s' src_cap x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 6. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> ?P'84 aaa ba c s' x xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 7. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 10. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (13 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> dcorres (?r'254 aaa ba c s' src_cap x) (?P255 aaa ba c s' src_cap) (?P'257 aaa ba c s' x) (KHeap_D.get_cap (transform_cslot_ptr a')) (CSpaceAcc_A.get_cap a')
 2. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; ?r'254 aaa ba c s' src_cap x rv rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R254 aaa ba c s' src_cap x rv) (?R'254 aaa ba c s' src_cap x rv') (when (rv = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))) (when (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0)))
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q256 aaa ba c s' src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>?R254 aaa ba c s' src_cap x\<rbrace>
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>?R'254 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 6. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 7. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 8. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> (?P255 aaa ba c s' src_cap and ?Q256 aaa ba c s' src_cap) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 9. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (?P'257 aaa ba c s' x and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 10. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R254 aaa ba c s' src_cap x rv) (?R'254 aaa ba c s' src_cap x rv') (when (rv = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))) (when (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0)))
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q256 aaa ba c s' src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>?R254 aaa ba c s' src_cap x\<rbrace>
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>?R'254 aaa ba c s' src_cap x\<rbrace>
 4. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 5. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 6. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 7. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and ?Q256 aaa ba c s' src_cap) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 8. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 9. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> (rv = TcbCap obj_id') = (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id')
 2. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres dc (?P272 aaa ba c s' src_cap x rv) (?P'274 aaa ba c s' src_cap x rv') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0))) (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q256 aaa ba c s' src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>rv xa. rv = TcbCap obj_id' \<longrightarrow> ?P272 aaa ba c s' src_cap x rv xa\<rbrace>
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>rv' xa. is_thread_cap rv' \<and> obj_ref_of rv' = obj_id' \<longrightarrow> ?P'274 aaa ba c s' src_cap x rv' xa\<rbrace>
 5. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 6. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 7. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 8. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and ?Q256 aaa ba c s' src_cap) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 9. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 10. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (rv = TcbCap obj_id')
 2. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres dc (?P272 aaa ba c s' src_cap x rv) (?P'274 aaa ba c s' src_cap x rv') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0))) (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q256 aaa ba c s' src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>rv xa. rv = TcbCap obj_id' \<longrightarrow> ?P272 aaa ba c s' src_cap x rv xa\<rbrace>
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>rv' xa. is_thread_cap rv' \<and> obj_ref_of rv' = obj_id' \<longrightarrow> ?P'274 aaa ba c s' src_cap x rv' xa\<rbrace>
 5. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 6. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 7. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 8. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and ?Q256 aaa ba c s' src_cap) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 9. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 10. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 2. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres dc (?P272 aaa ba c s' src_cap x rv) (?P'274 aaa ba c s' src_cap x rv') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0))) (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q256 aaa ba c s' src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>rv xa. rv = TcbCap obj_id' \<longrightarrow> ?P272 aaa ba c s' src_cap x rv xa\<rbrace>
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>rv' xa. is_thread_cap rv' \<and> obj_ref_of rv' = obj_id' \<longrightarrow> ?P'274 aaa ba c s' src_cap x rv' xa\<rbrace>
 5. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 6. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 7. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 8. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and ?Q256 aaa ba c s' src_cap) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 9. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 10. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.NullCap\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 2. \<And>aaa ba c s' src_cap x rv rv' x21 x22 x23 x24. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 3. \<And>aaa ba c s' src_cap x rv rv' x31 x32 x33. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 4. \<And>aaa ba c s' src_cap x rv rv' x41 x42 x43. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 5. \<And>aaa ba c s' src_cap x rv rv' x51 x52 x53. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 6. \<And>aaa ba c s' src_cap x rv rv' x61 x62 x63. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 7. \<And>aaa ba c s' src_cap x rv rv' x7. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = ThreadCap x7\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 8. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.DomainCap\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 9. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = IRQControlCap\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 10. \<And>aaa ba c s' src_cap x rv rv' x10. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.NullCap\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 2. \<And>aaa ba c s' src_cap x rv rv' x21 x22 x23 x24. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 3. \<And>aaa ba c s' src_cap x rv rv' x31 x32 x33. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 4. \<And>aaa ba c s' src_cap x rv rv' x41 x42 x43. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 5. \<And>aaa ba c s' src_cap x rv rv' x51 x52 x53. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 6. \<And>aaa ba c s' src_cap x rv rv' x61 x62 x63. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 7. \<And>aaa ba c s' src_cap x rv rv' x7. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = ThreadCap x7\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 8. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = cap.DomainCap\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 9. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = IRQControlCap\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
 10. \<And>aaa ba c s' src_cap x rv rv' x10. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> (case c of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) \<noteq> (case aaa of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (arch_cap.PageDirectoryCap obj_ref (Some asida)) \<Rightarrow> Some [VSRef (asida && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) None] | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None)) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'; rv' = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> (is_thread_cap rv' \<and> obj_ref_of rv' = obj_id') = (transform_cap rv' = TcbCap obj_id')
A total of 24 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres dc (?P272 aaa ba c s' src_cap x rv) (?P'274 aaa ba c s' src_cap x rv') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0))) (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q256 aaa ba c s' src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>rv xa. rv = TcbCap obj_id' \<longrightarrow> ?P272 aaa ba c s' src_cap x rv xa\<rbrace>
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>rv' xa. is_thread_cap rv' \<and> obj_ref_of rv' = obj_id' \<longrightarrow> ?P'274 aaa ba c s' src_cap x rv' xa\<rbrace>
 4. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 5. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 6. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 7. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and ?Q256 aaa ba c s' src_cap) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 8. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 9. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres dc (?P272 aaa ba c s' (transform_cap x) x (transform_cap rv')) (?P'274 aaa ba c s' (transform_cap x) x rv') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0))) (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q256 aaa ba c s' src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>rv xa. rv = TcbCap obj_id' \<longrightarrow> ?P272 aaa ba c s' src_cap x rv xa\<rbrace>
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>rv' xa. is_thread_cap rv' \<and> obj_ref_of rv' = obj_id' \<longrightarrow> ?P'274 aaa ba c s' src_cap x rv' xa\<rbrace>
 4. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 5. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 6. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 7. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and ?Q256 aaa ba c s' src_cap) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 8. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 9. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> transform_cap aaa = transform_cap aaa
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q256 aaa ba c s' src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>rv x. rv = TcbCap obj_id' \<longrightarrow> True\<rbrace>
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>rv' x. is_thread_cap rv' \<and> obj_ref_of rv' = obj_id' \<longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) x \<and> cte_wp_at (\<lambda>_. True) (ba, c) x \<and> not_idle_thread (fst (obj_id', tcb_cnode_index 0)) x \<and> not_idle_thread (fst (ba, c)) x \<and> valid_mdb x \<and> valid_idle x \<and> valid_etcbs x \<and> valid_objs x \<and> cap_aligned aaa\<rbrace>
 4. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 5. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 6. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 7. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and ?Q256 aaa ba c s' src_cap) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 8. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 9. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q256 aaa ba c s' src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>rv x. rv = TcbCap obj_id' \<longrightarrow> True\<rbrace>
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>rv' x. is_thread_cap rv' \<and> obj_ref_of rv' = obj_id' \<longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) x \<and> cte_wp_at (\<lambda>_. True) (ba, c) x \<and> not_idle_thread (fst (obj_id', tcb_cnode_index 0)) x \<and> not_idle_thread (fst (ba, c)) x \<and> valid_mdb x \<and> valid_idle x \<and> valid_etcbs x \<and> valid_objs x \<and> cap_aligned aaa\<rbrace>
 3. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 6. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and ?Q256 aaa ba c s' src_cap) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 7. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 8. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>rv' x. is_thread_cap rv' \<and> obj_ref_of rv' = obj_id' \<longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) x \<and> cte_wp_at (\<lambda>_. True) (ba, c) x \<and> not_idle_thread (fst (obj_id', tcb_cnode_index 0)) x \<and> not_idle_thread (fst (ba, c)) x \<and> valid_mdb x \<and> valid_idle x \<and> valid_etcbs x \<and> valid_objs x \<and> cap_aligned aaa\<rbrace>
 2. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 6. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 7. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 10. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (11 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 aaa ba c s' x\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>r s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> (is_thread_cap r \<and> obj_ref_of r = obj_id' \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (obj_id', tcb_cnode_index 0) s)\<rbrace>
 2. \<And>aaa ba c s' src_cap x rv s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> (is_thread_cap rv \<and> obj_ref_of rv = obj_id' \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (obj_id', tcb_cnode_index 0) s)\<rbrakk> \<Longrightarrow> is_thread_cap rv \<and> obj_ref_of rv = obj_id' \<longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> not_idle_thread (fst (obj_id', tcb_cnode_index 0)) s \<and> not_idle_thread (fst (ba, c)) s \<and> valid_mdb s \<and> valid_idle s \<and> valid_etcbs s \<and> valid_objs s \<and> cap_aligned aaa
 3. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 6. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 7. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'258 aaa ba c s' x) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 8. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> tcb_cnode_index 0 \<in> dom tcb_cap_cases
 2. \<And>aaa ba c s' src_cap x rv s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> (is_thread_cap rv \<and> obj_ref_of rv = obj_id' \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (obj_id', tcb_cnode_index 0) s)\<rbrakk> \<Longrightarrow> is_thread_cap rv \<and> obj_ref_of rv = obj_id' \<longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> not_idle_thread (fst (obj_id', tcb_cnode_index 0)) s \<and> not_idle_thread (fst (ba, c)) s \<and> valid_mdb s \<and> valid_idle s \<and> valid_etcbs s \<and> valid_objs s \<and> cap_aligned aaa
 3. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 6. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 7. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 8. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>aaa ba c s' x rv s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread (obj_ref_of rv) s'; tcb_at (obj_ref_of rv) s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; cte_wp_at ((=) cap.NullCap) (obj_ref_of rv, tcb_cnode_index 0) s; cte_wp_at (\<lambda>_. True) (ba, c) s; valid_global_refs s; valid_idle s; valid_irq_node s; valid_mdb s; not_idle_thread ba s; valid_objs s; valid_etcbs s; ex_cte_cap_wp_to (\<lambda>_. True) (obj_ref_of rv, tcb_cnode_index 0) s; is_thread_cap rv; obj_id' = obj_ref_of rv\<rbrakk> \<Longrightarrow> not_idle_thread (obj_ref_of rv) s \<and> cap_aligned aaa
 2. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 6. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 7. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 10. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>aaa ba c s' x rv s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; obj_ref_of rv \<noteq> idle_thread s'; tcb_at (obj_ref_of rv) s'; s' \<turnstile> aaa; fst a' \<noteq> idle_thread s'; Structures_A.is_cnode_cap aaa; ba \<noteq> idle_thread s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; cte_wp_at ((=) cap.NullCap) (obj_ref_of rv, tcb_cnode_index 0) s; cte_wp_at (\<lambda>_. True) (ba, c) s; valid_global_refs s; valid_idle s; valid_irq_node s; valid_mdb s; ba \<noteq> idle_thread s; valid_objs s; valid_etcbs s; is_thread_cap rv; obj_id' = obj_ref_of rv; obj_ref_of rv \<noteq> idle_thread s\<rbrakk> \<Longrightarrow> cap_aligned aaa
 2. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 4. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 5. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 6. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 7. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 10. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R71 aaa ba c s' src_cap x rv) (?R'71 aaa ba c s' src_cap x rv') (return (Inr ())) (return (Inr ()))
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>?R71 aaa ba c s' src_cap x\<rbrace>
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>?R'71 aaa ba c s' src_cap x\<rbrace>
 4. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 5. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 6. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 9. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>aaa ba c s' src_cap x rv rv'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (\<lambda>_. True) (return (Inr ())) (return (Inr ()))
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>\<lambda>rv' _. True\<rbrace>
 4. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 5. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 6. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 9. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 aaa ba c s' src_cap\<rbrace> when (Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa)) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)) \<sqinter> insert_cap_sibling (transform_cap aaa) (transform_cslot_ptr (ba, c)) (transform_cslot_ptr (obj_id', tcb_cnode_index 0)))
od) \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>\<lambda>rv' _. True\<rbrace>
 3. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and ?Q73 aaa ba c s' src_cap\<rbrace>
 4. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 5. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 8. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>aaa ba c s' src_cap x. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 aaa ba c s' x\<rbrace> when (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (is_thread_cap cap' \<and> obj_ref_of cap' = obj_id') (cap_insert aaa (ba, c) (obj_id', tcb_cnode_index 0))
od) \<lbrace>\<lambda>rv' _. True\<rbrace>
 2. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and (if Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))\<rbrace>
 3. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) xa) and ?Q'75 aaa ba c s' x and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 4. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 7. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>aaa ba c s' src_cap x rv s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'; src_cap = transform_cap x; Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa; True\<rbrakk> \<Longrightarrow> True
 2. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and (if Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))\<rbrace>
 3. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) xa) and (\<lambda>_. True) and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 4. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 7. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 aaa ba c (transform s') s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ba, c)) \<lbrace>\<lambda>src_cap. (\<lambda>x. Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and (if Types_D.is_cnode_cap src_cap \<and> cap_object src_cap = cap_object (transform_cap aaa) then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))\<rbrace>
 2. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x. (\<lambda>xa. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) xa) and (\<lambda>_. True) and (\<lambda>s. Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q57 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 6. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>x s. ((case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case x of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa x | ArchObjectCap ac \<Rightarrow> case x of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa x | _ \<Rightarrow> same_region_as aaa x) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) s) \<and> True \<and> (Structures_A.is_cnode_cap x \<and> obj_refs x = obj_refs aaa \<longrightarrow> bits_of x = bits_of aaa)\<rbrace>
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr (ba, c)) a \<noteq> None \<longrightarrow> ((\<lambda>x. Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and (if Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))) a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and ?Q'55 aaa ba c s s' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?P389 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>rv s. (case aaa of cap.UntypedCap dev r bits free \<Rightarrow> False | IRQControlCap \<Rightarrow> case rv of IRQHandlerCap n \<Rightarrow> False | _ \<Rightarrow> same_region_as aaa rv | ArchObjectCap ac \<Rightarrow> case rv of ArchObjectCap a \<Rightarrow> same_aobject_as ac a | _ \<Rightarrow> same_region_as aaa rv | _ \<Rightarrow> same_region_as aaa rv) \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) s\<rbrace>
 2. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'388 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>rv s. True \<and> (Structures_A.is_cnode_cap rv \<and> obj_refs rv = obj_refs aaa \<longrightarrow> bits_of rv = bits_of aaa)\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr (ba, c)) a \<noteq> None \<longrightarrow> ((\<lambda>x. Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and (if Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))) a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and (\<lambda>b. ?P389 aaa ba c s s' a b \<and> ?P'388 aaa ba c s s' a b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 6. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?P389 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>rv. valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)\<rbrace>
 2. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'388 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>rv s. True \<and> (Structures_A.is_cnode_cap rv \<and> obj_refs rv = obj_refs aaa \<longrightarrow> bits_of rv = bits_of aaa)\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr (ba, c)) a \<noteq> None \<longrightarrow> ((\<lambda>x. Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and (if Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))) a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and (\<lambda>b. ?P389 aaa ba c s s' a b \<and> ?P'388 aaa ba c s s' a b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 6. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'388 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>rv s. True \<and> (Structures_A.is_cnode_cap rv \<and> obj_refs rv = obj_refs aaa \<longrightarrow> bits_of rv = bits_of aaa)\<rbrace>
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr (ba, c)) a \<noteq> None \<longrightarrow> ((\<lambda>x. Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and (if Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))) a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and (\<lambda>b. (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) b \<and> ?P'388 aaa ba c s s' a b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'388 aaa ba c (transform s') s' ()\<rbrace> CSpaceAcc_A.get_cap (ba, c) \<lbrace>\<lambda>rv s. Structures_A.is_cnode_cap rv \<and> obj_refs rv = obj_refs aaa \<longrightarrow> bits_of rv = bits_of aaa\<rbrace>
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr (ba, c)) a \<noteq> None \<longrightarrow> ((\<lambda>x. Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and (if Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))) a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and (\<lambda>b. (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) b \<and> ?P'388 aaa ba c s s' a b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; \<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s'\<rbrakk> \<Longrightarrow> Structures_A.is_cnode_cap aaa
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr (ba, c)) a \<noteq> None \<longrightarrow> ((\<lambda>x. Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and (if Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))) a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and (\<lambda>a. (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) a \<and> (\<forall>aa b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (aa, b) a) \<and> a \<turnstile> aaa \<and> valid_objs a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (4 subgoals):
 1. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr (ba, c)) a \<noteq> None \<longrightarrow> ((\<lambda>x. Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) x) and (if Types_D.is_cnode_cap (the (opt_cap (transform_cslot_ptr (ba, c)) a)) \<and> cap_object (the (opt_cap (transform_cslot_ptr (ba, c)) a)) = cap_object (transform_cap aaa) then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))) a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and (\<lambda>a. (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) a \<and> (\<forall>aa b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (aa, b) a) \<and> a \<turnstile> aaa \<and> valid_objs a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (4 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; valid_etcbs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' s'; tcb_at obj_id' s'; s' \<turnstile> aaa; not_idle_thread (fst a') s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; no_cap_to_obj_dr_emp aaa s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 aaa ba c (transform s') s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_cspace_slot \<lbrace>\<lambda>x xa. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and (\<lambda>a. (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) a \<and> (\<forall>aa b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (aa, b) a) \<and> a \<turnstile> aaa \<and> valid_objs a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 aaa ba c s s') sa
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (3 subgoals):
 1. \<And>aaa ba c s s'. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst (ba, c)) and valid_etcbs and (\<lambda>a. (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> not_idle_thread ba s \<and> valid_objs s \<and> valid_etcbs s \<and> True)) a \<and> (\<forall>aa b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (aa, b) a) \<and> a \<turnstile> aaa \<and> valid_objs a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True)) sa
 3. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (3 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c (transform s') s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>a b. valid_global_refs b \<and> valid_idle b \<and> valid_irq_node b \<and> valid_mdb b \<and> valid_objs b \<and> not_idle_thread ba b \<and> b \<turnstile> aaa \<and> not_idle_thread (fst a') b \<and> valid_etcbs b \<and> cte_wp_at (\<lambda>_. True) (ba, c) b \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) b \<and> (\<forall>a ba. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, ba) b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True)) sa
 3. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c (transform s') s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>r s. invs s \<and> valid_etcbs s \<and> not_idle_thread ba s \<and> s \<turnstile> aaa \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp aaa s\<rbrace>, \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>aaa ba c s' rv s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; invs s \<and> valid_etcbs s \<and> not_idle_thread ba s \<and> s \<turnstile> aaa \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp aaa s\<rbrakk> \<Longrightarrow> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread ba s \<and> s \<turnstile> aaa \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> (\<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s)
 3. \<And>aaa ba c s' e s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; True\<rbrakk> \<Longrightarrow> True
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True)) sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>aaa ba c s'. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; ba \<noteq> idle_thread s'; obj_id' \<noteq> idle_thread s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; fst a' \<noteq> idle_thread s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 aaa ba c (transform s') s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 0) \<lbrace>\<lambda>r s. invs s \<and> valid_etcbs s \<and> ba \<noteq> idle_thread s \<and> s \<turnstile> aaa \<and> fst a' \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp aaa s\<rbrace>, \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>aaa ba c s' rv s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; invs s \<and> valid_etcbs s \<and> not_idle_thread ba s \<and> s \<turnstile> aaa \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp aaa s\<rbrakk> \<Longrightarrow> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread ba s \<and> s \<turnstile> aaa \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> (\<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s)
 3. \<And>aaa ba c s' e s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; True\<rbrakk> \<Longrightarrow> True
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True)) sa
 5. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'22 aaa ba c s s') sa proof (prove)
goal (4 subgoals):
 1. \<And>aaa ba c s' rv s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; invs s \<and> valid_etcbs s \<and> not_idle_thread ba s \<and> s \<turnstile> aaa \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp aaa s\<rbrakk> \<Longrightarrow> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread ba s \<and> s \<turnstile> aaa \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> (\<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s)
 2. \<And>aaa ba c s' e s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; True\<rbrakk> \<Longrightarrow> True
 3. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True)) sa
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>a. True \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) a \<and> valid_etcbs a \<and> ba \<noteq> idle_thread a \<and> a \<turnstile> aaa \<and> fst a' \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (ba, c) a \<and> True \<and> no_cap_to_obj_dr_emp aaa a)) sa proof (prove)
goal (4 subgoals):
 1. \<And>aaa ba c s' s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; invs s \<and> valid_etcbs s \<and> not_idle_thread ba s \<and> s \<turnstile> aaa \<and> not_idle_thread (fst a') s \<and> cte_wp_at (\<lambda>_. True) (ba, c) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> no_cap_to_obj_dr_emp aaa s\<rbrakk> \<Longrightarrow> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 0) s \<and> (\<forall>a b. \<not> cte_wp_at (\<lambda>c. obj_refs c = obj_refs aaa \<and> table_cap_ref c \<noteq> table_cap_ref aaa) (a, b) s)
 2. \<And>aaa ba c s' e s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; True\<rbrakk> \<Longrightarrow> True
 3. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True)) sa
 4. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>a. True \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) a \<and> valid_etcbs a \<and> ba \<noteq> idle_thread a \<and> a \<turnstile> aaa \<and> fst a' \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (ba, c) a \<and> True \<and> no_cap_to_obj_dr_emp aaa a)) sa proof (prove)
goal (3 subgoals):
 1. \<And>aaa ba c s' e s. \<lbrakk>croot' = Some (aaa, ba, c); invs s'; Structures_A.is_cnode_cap aaa; not_idle_thread ba s'; not_idle_thread obj_id' s'; s' \<turnstile> aaa; no_cap_to_obj_dr_emp aaa s'; not_idle_thread (fst a') s'; tcb_at obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; cte_wp_at (\<lambda>_. True) (ba, c) s'; True\<rbrakk> \<Longrightarrow> True
 2. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True)) sa
 3. \<And>aaa ba c s s' sa. \<lbrakk>croot' = Some (aaa, ba, c); s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and not_idle_thread obj_id' and tcb_at obj_id' and valid_cap aaa and not_idle_thread (fst a') and (\<lambda>y. Structures_A.is_cnode_cap aaa) and not_idle_thread ba and cte_wp_at (\<lambda>_. True) (ba, c) and no_cap_to_obj_dr_emp aaa) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) and invs and emptyable (obj_id', tcb_cnode_index 0) and not_idle_thread (fst (obj_id', tcb_cnode_index 0)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>a. True \<and> (invs and emptyable (obj_id', tcb_cnode_index 0)) a \<and> valid_etcbs a \<and> ba \<noteq> idle_thread a \<and> a \<turnstile> aaa \<and> fst a' \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (ba, c) a \<and> True \<and> no_cap_to_obj_dr_emp aaa a)) sa proof (prove)
goal (1 subgoal):
 1. \<And>aaa ba c sa. \<lbrakk>croot' = Some (aaa, ba, c); invs sa; valid_etcbs sa; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; obj_id' \<noteq> idle_thread sa; tcb_at obj_id' sa; sa \<turnstile> aaa; fst a' \<noteq> idle_thread sa; Structures_A.is_cnode_cap aaa; ba \<noteq> idle_thread sa; cte_wp_at (\<lambda>_. True) (ba, c) sa; no_cap_to_obj_dr_emp aaa sa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 0) sa proof (prove)
goal (1 subgoal):
 1. \<And>aaa ba c sa. \<lbrakk>croot' = Some (aaa, ba, c); invs sa; valid_etcbs sa; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; obj_id' \<noteq> idle_thread sa; sa \<turnstile> aaa; fst a' \<noteq> idle_thread sa; Structures_A.is_cnode_cap aaa; ba \<noteq> idle_thread sa; cte_wp_at (\<lambda>_. True) (ba, c) sa; no_cap_to_obj_dr_emp aaa sa\<rbrakk> \<Longrightarrow> tcb_cnode_index 0 \<in> dom tcb_cap_cases proof (prove)
goal:
No subgoals!