theory Tcb_R

lemma decodeSetSpace_corres:
  notes if_cong [cong]
  shows
 "\<lbrakk> cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras';
      is_thread_cap cap \<rbrakk> \<Longrightarrow>
  corres (ser \<oplus> tcbinv_relation)
         (invs and valid_cap cap and (\<lambda>s. \<forall>x \<in> set extras. cte_at (snd x) s))
         (invs' and valid_cap' cap'  and (\<lambda>s. \<forall>x \<in> set extras'. cte_at' (snd x) s))
      (decode_set_space args cap slot extras)
      (decodeSetSpace args cap' (cte_map slot) extras')" apply (simp    add: decode_set_space_def decodeSetSpace_def
                      Let_def
           split del: if_split) apply (cases "3 \<le> length args \<and> 2 \<le> length extras'") apply (clarsimp simp: val_le_length_Cons list_all2_Cons2
              split del: if_split) apply (simp add: liftE_bindE liftM_def unlessE_whenE
                    getThreadCSpaceRoot getThreadVSpaceRoot
                 split del: if_split) apply (rule corres_guard_imp) apply (rule corres_split[OF slotCapLongRunningDelete_corres]) apply (clarsimp simp: is_cap_simps get_tcb_ctable_ptr_def cte_map_tcb_0) apply (rule corres_split[OF slotCapLongRunningDelete_corres]) apply (clarsimp simp: is_cap_simps get_tcb_vtable_ptr_def cte_map_tcb_1[simplified] objBits_defs) apply (rule corres_split_norE) apply (rule corres_whenE) apply simp apply (rule corres_trivial, simp) apply simp apply (simp(no_asm) add: split_def unlessE_throwError_returnOk
                                    bindE_assoc cap_CNode_case_throw unlessE_whenE
                         split del: if_split) apply (rule corres_splitEE) apply (rule deriveCap_corres) apply (clarsimp simp: cap_map_update_data) apply simp apply (rule corres_split_norE) apply (rule corres_whenE) apply simp apply (rule corres_trivial, simp) apply simp apply (rule corres_splitEE) apply (rule deriveCap_corres) apply (fastforce dest: list_all2_nthD2[where p=0] simp: cap_map_update_data) apply simp apply (rule corres_split_norE) apply (unfold unlessE_whenE) apply (rule corres_whenE) apply (case_tac vroot_cap', simp_all add:
                                       is_valid_vtable_root_def isValidVTableRoot_def
                                       ARM_H.isValidVTableRoot_def)[1] apply (rename_tac arch_cap) apply (clarsimp, case_tac arch_cap, simp_all)[1] apply (simp split: option.split) apply (rule corres_trivial, simp) apply simp apply (rule corres_trivial) apply (clarsimp simp: returnOk_def newroot_rel_def is_cap_simps
                                         list_all2_conv_all_nth split_def) apply wp+ apply ((simp only: simp_thms pred_conj_def | wp)+)[2] apply (unfold whenE_def, wp+)[2] apply ((simp split del: if_split | wp | rule hoare_drop_imps)+)[2] apply (unfold whenE_def, wp+)[2] apply simp apply (wp hoare_drop_imps)+ apply (clarsimp simp: get_tcb_ctable_ptr_def get_tcb_vtable_ptr_def
                          is_cap_simps valid_cap_def tcb_at_cte_at_0
                          tcb_at_cte_at_1[simplified]) apply fastforce apply (frule list_all2_lengthD) apply (clarsimp split: list.split) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (decode_set_space args cap slot extras) (decodeSetSpace args cap' (cte_map slot) extras') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; 3 \<le> length args \<and> 2 \<le> length extras'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE)
 2. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (2 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) (doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
yc <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete));
yc <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE)
 2. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (2 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) (do x <- slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap));
xa <- slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap));
doE yc <- whenE (\<not> x \<longrightarrow> xa) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE
od) (do x <- slotCapLongRunningDelete (capTCBPtr cap');
xa <- slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits);
doE yc <- whenE (\<not> x \<longrightarrow> xa) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE
od)
 2. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (4 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?Q46 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) (?Q'46 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) (do x <- slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap));
xa <- slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap));
doE yc <- whenE (\<not> x \<longrightarrow> xa) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE
od) (do x <- slotCapLongRunningDelete (capTCBPtr cap');
xa <- slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits);
doE yc <- whenE (\<not> x \<longrightarrow> xa) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE
od)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> ?Q46 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> ?Q'46 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s
 4. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (7 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> cte_map (get_tcb_ctable_ptr (obj_ref_of cap)) = capTCBPtr cap'
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x) (?R'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa) (do xa <- slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap));
doE yc <- whenE (\<not> x \<longrightarrow> xa) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE
od) (do x <- slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits);
doE yc <- whenE (\<not> xa \<longrightarrow> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE
od)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>?R50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>?R'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 7. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (6 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x) (?R'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa) (do xa <- slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap));
doE yc <- whenE (\<not> x \<longrightarrow> xa) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE
od) (do x <- slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits);
doE yc <- whenE (\<not> xa \<longrightarrow> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE
od)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>?R50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>?R'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 6. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (9 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> cte_map (get_tcb_vtable_ptr (obj_ref_of cap)) = capTCBPtr cap' + 2 ^ cteSizeBits
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R61 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb) (?R'61 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc) (doE yc <- whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE yc <- whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>?R61 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>?R'61 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 9. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (8 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R61 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb) (?R'61 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc) (doE yc <- whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE yc <- whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>?R61 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>?R'61 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 8. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (11 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P77 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb) (?P'79 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc) (whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation)) (whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (doE croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. ?P77 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. ?P'79 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> (\<not> x \<longrightarrow> xb) = (\<not> xa \<longrightarrow> xc)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P87 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb) (?P'89 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) (throwError Fault_H.syscall_error.IllegalOperation)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> dc () ()
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (doE croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE)
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> ?P87 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb s) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> ?P'89 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc s) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P87 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb) (?P'89 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) (throwError Fault_H.syscall_error.IllegalOperation)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (doE croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE)
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> ?P87 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb s) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> ?P'89 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc s) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (doE croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (doE croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cte_map (ac, bb)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', cte_map (ae, bc)) else throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some cRoot) (Some vRoot) None)
odE)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 10. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (10 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (doE croot_cap' <- derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab);
ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE cRootCap' <- global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a);
x <- whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
x <- whenE (\<not> isValidVTableRoot vRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (vRootCap', cte_map (ae, bc))) None)
odE)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'76 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 10. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- unlessE (is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (13 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ?r'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (?P95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (?P'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc) (derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab)) (global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; ?r'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap') (?R'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap') (doE ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE x <- whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
x <- whenE (\<not> isValidVTableRoot vRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (vRootCap', cte_map (ae, bc))) None)
odE)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>?R95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>?R'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?P95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?P'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> cap_relation ((if ya = 0 then id else update_cap_data False ya) ab) (if ya = 0 then a else global.updateCapData False ya a)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> cte_map (ac, bb) = cte_map (ac, bb)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap') (?R'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap') (doE ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE x <- whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
x <- whenE (\<not> isValidVTableRoot vRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (vRootCap', cte_map (ae, bc))) None)
odE)
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>?R95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>?R'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> cte_map (ac, bb) = cte_map (ac, bb)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap') (?R'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap') (doE ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE x <- whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
x <- whenE (\<not> isValidVTableRoot vRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (vRootCap', cte_map (ae, bc))) None)
odE)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>?R95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>?R'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap') (?R'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap') (doE ya <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE x <- whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
x <- whenE (\<not> isValidVTableRoot vRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (vRootCap', cte_map (ae, bc))) None)
odE)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>?R95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>?R'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P108 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap') (?P'110 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap') (whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation)) (whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (?R'107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (doE vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
x <- whenE (\<not> isValidVTableRoot vRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (vRootCap', cte_map (ae, bc))) None)
odE)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. ?P108 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. ?P'110 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap' and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> (\<not> is_cnode_cap croot_cap') = (\<not> isCNodeCap cRootCap')
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P118 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap') (?P'120 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) (throwError Fault_H.syscall_error.IllegalOperation)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> dc () ()
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (?R'107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (doE vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
x <- whenE (\<not> isValidVTableRoot vRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (vRootCap', cte_map (ae, bc))) None)
odE)
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> ?P118 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' s) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> ?P'120 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap' s) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P118 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap') (?P'120 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) (throwError Fault_H.syscall_error.IllegalOperation)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (?R'107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (doE vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
x <- whenE (\<not> isValidVTableRoot vRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (vRootCap', cte_map (ae, bc))) None)
odE)
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> ?P118 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' s) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> ?P'120 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap' s) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (?R'107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (doE vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
x <- whenE (\<not> isValidVTableRoot vRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (vRootCap', cte_map (ae, bc))) None)
odE)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (?R'107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (doE vroot_cap' <- derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad);
ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE vRootCap' <- global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa);
x <- whenE (\<not> isValidVTableRoot vRootCap') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (vRootCap', cte_map (ae, bc))) None)
odE)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'107 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ?r'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (?P126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (?P'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap') (derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad)) (global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; ?r'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?R'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (doE ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE x <- whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None)
odE)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>?R126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>?R'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?P126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?P'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> cap_relation ((if yb = 0 then id else update_cap_data False yb) ad) (if yb = 0 then aa else global.updateCapData False yb aa)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> cte_map (ae, bc) = cte_map (ae, bc)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?R'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (doE ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE x <- whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None)
odE)
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>?R126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>?R'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> cte_map (ae, bc) = cte_map (ae, bc)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?R'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (doE ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE x <- whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None)
odE)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>?R126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>?R'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?R'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (doE ya <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)
odE) (doE x <- whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None)
odE)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>?R126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>?R'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P143 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?P'145 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation)) (whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)) (returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None))
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. ?P143 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. ?P'145 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv' and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P143 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?P'145 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation)) (whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)) (returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None))
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. ?P143 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. ?P'145 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv' and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> (\<not> is_valid_vtable_root vroot_cap') = (\<not> isValidVTableRoot rv')
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P153 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?P'155 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) (throwError Fault_H.syscall_error.IllegalOperation)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> dc () ()
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)) (returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None))
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. (\<lambda>s. \<not> is_valid_vtable_root vroot_cap' \<longrightarrow> ?P153 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' s) and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. (\<lambda>s. \<not> isValidVTableRoot rv' \<longrightarrow> ?P'155 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv' s) and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv' x12. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; \<exists>a'. acap_relation x12 a' \<and> rv' = capability.ArchObjectCap a'; vroot_cap' = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> (\<forall>r a. x12 \<noteq> arch_cap.PageDirectoryCap r (Some a)) = (\<not> (case rv' of capability.ArchObjectCap (arch_capability.PageDirectoryCap x None) \<Rightarrow> False | capability.ArchObjectCap (arch_capability.PageDirectoryCap x (Some xa)) \<Rightarrow> True | capability.ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P153 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?P'155 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) (throwError Fault_H.syscall_error.IllegalOperation)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> dc () ()
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)) (returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None))
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. (\<lambda>s. \<not> is_valid_vtable_root vroot_cap' \<longrightarrow> ?P153 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' s) and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. (\<lambda>s. \<not> isValidVTableRoot rv' \<longrightarrow> ?P'155 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv' s) and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv' arch_cap. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; \<exists>a'. acap_relation arch_cap a' \<and> rv' = capability.ArchObjectCap a'; vroot_cap' = cap.ArchObjectCap arch_cap\<rbrakk> \<Longrightarrow> (\<forall>r a. arch_cap \<noteq> arch_cap.PageDirectoryCap r (Some a)) = (\<not> (case rv' of capability.ArchObjectCap (arch_capability.PageDirectoryCap x None) \<Rightarrow> False | capability.ArchObjectCap (arch_capability.PageDirectoryCap x (Some xa)) \<Rightarrow> True | capability.ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P153 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?P'155 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) (throwError Fault_H.syscall_error.IllegalOperation)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> dc () ()
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)) (returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None))
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. (\<lambda>s. \<not> is_valid_vtable_root vroot_cap' \<longrightarrow> ?P153 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' s) and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. (\<lambda>s. \<not> isValidVTableRoot rv' \<longrightarrow> ?P'155 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv' s) and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa croot_cap' cRootCap' arch_cap a' x51 x52. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; cap_relation croot_cap' cRootCap'; a' = arch_capability.PageDirectoryCap x51 x52; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (x52 = None) = (\<not> (case x52 of None \<Rightarrow> False | Some xa \<Rightarrow> True))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P153 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?P'155 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) (throwError Fault_H.syscall_error.IllegalOperation)
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> dc () ()
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)) (returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None))
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. (\<lambda>s. \<not> is_valid_vtable_root vroot_cap' \<longrightarrow> ?P153 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' s) and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. (\<lambda>s. \<not> isValidVTableRoot rv' \<longrightarrow> ?P'155 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv' s) and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> dc) (?P153 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap') (?P'155 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) (throwError Fault_H.syscall_error.IllegalOperation)
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)) (returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None))
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. (\<lambda>s. \<not> is_valid_vtable_root vroot_cap' \<longrightarrow> ?P153 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' s) and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. (\<lambda>s. \<not> isValidVTableRoot rv' \<longrightarrow> ?P'155 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv' s) and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)) (returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None))
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. (\<lambda>s. \<not> is_valid_vtable_root vroot_cap' \<longrightarrow> True) and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. (\<lambda>s. \<not> isValidVTableRoot rv' \<longrightarrow> True) and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv') (returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)) (returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. ?R'142 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. (\<lambda>s. \<not> is_valid_vtable_root vroot_cap' \<longrightarrow> True) and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. (\<lambda>s. \<not> isValidVTableRoot rv' \<longrightarrow> True) and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (\<lambda>_. True) (\<lambda>_. True) (returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl y)) None None (Some (croot_cap', ac, bb)) (Some (vroot_cap', ae, bc)) None)) (returnOk (tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Some y) None None (Some (cRootCap', cte_map (ac, bb))) (Some (rv', cte_map (ae, bc))) None))
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. (\<lambda>s. \<not> is_valid_vtable_root vroot_cap' \<longrightarrow> True) and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. (\<lambda>s. \<not> isValidVTableRoot rv' \<longrightarrow> True) and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace> whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap' rv'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'; cap_relation vroot_cap' rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace> whenE (\<not> isValidVTableRoot rv') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap'. (\<lambda>s. \<not> is_valid_vtable_root vroot_cap' \<longrightarrow> True) and ?Q144 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' vroot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. (\<lambda>s. \<not> isValidVTableRoot rv' \<longrightarrow> True) and ?Q'146 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and ?Q126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'207 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> derive_cap (ae, bc) ((if yb = 0 then id else update_cap_data False yb) ad) \<lbrace>\<lambda>vroot_cap' s. (\<not> is_valid_vtable_root vroot_cap' \<longrightarrow> True) \<and> True \<and> True\<rbrace>, -
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace> global.deriveCap (cte_map (ae, bc)) (if yb = 0 then aa else global.updateCapData False yb aa) \<lbrace>\<lambda>rv'. (\<lambda>s. \<not> isValidVTableRoot rv' \<longrightarrow> True) and (\<lambda>s. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ae, bc) and (\<lambda>s. True \<and> ?P'207 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap' s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and ?Q'126 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
A total of 15 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace> whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (ae, bc) and (\<lambda>s. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap' cRootCap'. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc; cap_relation croot_cap' cRootCap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace> whenE (\<not> isCNodeCap cRootCap') (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) and valid_mdb' and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and ?Q109 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc croot_cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and ?Q'111 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc cRootCap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
A total of 13 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> derive_cap (ac, bb) ((if ya = 0 then id else update_cap_data False ya) ab) \<lbrace>\<lambda>croot_cap'. (\<lambda>s. \<not> is_cnode_cap croot_cap' \<longrightarrow> True) and (\<lambda>s. True \<and> (\<not> is_cnode_cap croot_cap' \<longrightarrow> True) \<and> (\<not> \<not> is_cnode_cap croot_cap' \<longrightarrow> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> True \<and> True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace> global.deriveCap (cte_map (ac, bb)) (if ya = 0 then a else global.updateCapData False ya a) \<lbrace>\<lambda>cRootCap'. (\<lambda>s. \<not> isCNodeCap cRootCap' \<longrightarrow> True) and (\<lambda>s. True \<and> (\<not> isCNodeCap cRootCap' \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cRootCap' \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> valid_mdb' s \<and> True \<and> True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. cte_wp_at (\<lambda>_. True) (ac, bb) and ?Q95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>xd. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and ?Q'95 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 9. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 10. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace> whenE (\<not> x \<longrightarrow> xb) (throwError ExceptionTypes_A.syscall_error.IllegalOperation) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (ac, bb) and (\<lambda>a. True \<and> cte_wp_at (\<lambda>_. True) (ae, bc) a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb xc. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa; xb = xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace> whenE (\<not> xa \<longrightarrow> xc) (throwError Fault_H.syscall_error.IllegalOperation) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) and valid_mdb' and (\<lambda>a. True \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) a \<and> valid_mdb' a)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and ?Q78 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xb\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and ?Q'80 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa xc\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 7. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 8. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 9. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- whenE (\<not> (can_chg_cr \<and> can_chg_vr)) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
whenE (\<not> (canChangeCRoot \<and> canChangeVRoot)) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (7 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb. (\<lambda>s. (\<not> x \<longrightarrow> xb) \<longrightarrow> True) and (\<lambda>s. True \<and> ((\<not> x \<longrightarrow> xb) \<longrightarrow> True) \<and> (\<not> (\<not> x \<longrightarrow> xb) \<longrightarrow> cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> True \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s))\<rbrace>
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and (\<lambda>s. True \<and> ((\<not> xa \<longrightarrow> xc) \<longrightarrow> True) \<and> (\<not> (\<not> xa \<longrightarrow> xc) \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> valid_mdb' s \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> valid_mdb' s))\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 7. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- whenE (\<not> (can_chg_cr \<and> can_chg_vr)) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
whenE (\<not> (canChangeCRoot \<and> canChangeVRoot)) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (7 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>xb s. \<not> xa \<and> \<not> xb \<longrightarrow> cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s\<rbrace>
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x xa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap' + 2 ^ cteSizeBits) \<lbrace>\<lambda>xc. (\<lambda>s. (\<not> xa \<longrightarrow> xc) \<longrightarrow> True) and (\<lambda>s. True \<and> ((\<not> xa \<longrightarrow> xc) \<longrightarrow> True) \<and> (\<not> (\<not> xa \<longrightarrow> xc) \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> valid_mdb' s \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> valid_mdb' s))\<rbrace>
 3. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap)) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and ?Q64 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa x\<rbrace>
 4. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa\<rbrace> slotCapLongRunningDelete (capTCBPtr cap') \<lbrace>\<lambda>xa. invs' and ?Q'65 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa xa\<rbrace>
 5. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and ?Q50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 6. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and ?Q'50 y a ya aa ysc yb ysd ab ac bb ad ae bc zsa) s
 7. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- whenE (\<not> (can_chg_cr \<and> can_chg_vr)) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
whenE (\<not> (canChangeCRoot \<and> canChangeVRoot)) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (3 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs and valid_cap cap and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s \<and> (\<forall>x\<in>set zsa. cte_wp_at (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (get_tcb_ctable_ptr (obj_ref_of cap)) and invs and (cte_wp_at (\<lambda>_. True) (get_tcb_vtable_ptr (obj_ref_of cap)) and invs and (\<lambda>s. cte_wp_at (\<lambda>_. True) (ac, bb) s \<and> cte_wp_at (\<lambda>_. True) (ae, bc) s))) s
 2. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and (invs' and (\<lambda>s. True \<and> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> valid_mdb' s \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> valid_mdb' s))) s
 3. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- whenE (\<not> (can_chg_cr \<and> can_chg_vr)) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
whenE (\<not> (canChangeCRoot \<and> canChangeVRoot)) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (2 subgoals):
 1. \<And>y a ya aa ysc yb ysd ab ac bb ad ae bc zsa s. \<lbrakk>cap_relation cap cap'; is_thread_cap cap; args = y # ya # yb # ysd; extras' = (a, cte_map (ac, bb)) # (aa, cte_map (ae, bc)) # ysc; extras = (ab, ac, bb) # (ad, ae, bc) # zsa; cap_relation ab a; cap_relation ad aa; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) zsa ysc; (invs' and valid_cap' cap' and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> (\<forall>x\<in>set ysc. cte_wp_at' (\<lambda>_. True) (snd x) s))) s\<rbrakk> \<Longrightarrow> (invs' and (invs' and (\<lambda>s. True \<and> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ac, bb)) s \<and> valid_mdb' s \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ae, bc)) s \<and> valid_mdb' s))) s
 2. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- whenE (\<not> (can_chg_cr \<and> can_chg_vr)) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
whenE (\<not> (canChangeCRoot \<and> canChangeVRoot)) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras')\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- whenE (\<not> (can_chg_cr \<and> can_chg_vr)) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
whenE (\<not> (canChangeCRoot \<and> canChangeVRoot)) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation cap cap'; list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) extras extras'; is_thread_cap cap; \<not> (3 \<le> length args \<and> 2 \<le> length extras'); length extras = length extras'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>set extras. cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and (\<lambda>s. \<forall>x\<in>set extras'. cte_wp_at' (\<lambda>_. True) (snd x) s)) (doE y <- whenE (length args < 3 \<or> length extras < 2) (throwError ExceptionTypes_A.syscall_error.TruncatedMessage);
can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr (obj_ref_of cap))));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr (obj_ref_of cap))));
y <- whenE (\<not> (can_chg_cr \<and> can_chg_vr)) (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
croot_cap' <- derive_cap (snd (extras ! 0)) ((if args ! Suc 0 = 0 then id else update_cap_data False (args ! Suc 0)) (fst (extras ! 0)));
y <- whenE (\<not> is_cnode_cap croot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
vroot_cap' <- derive_cap (snd (extras ! Suc 0)) ((if args ! 2 = 0 then id else update_cap_data False (args ! 2)) (fst (extras ! Suc 0)));
y <- whenE (\<not> is_valid_vtable_root vroot_cap') (throwError ExceptionTypes_A.syscall_error.IllegalOperation);
returnOk (tcb_invocation.ThreadControl (obj_ref_of cap) slot (Some (to_bl (args ! 0))) None None (Some (croot_cap', snd (extras ! 0))) (Some (vroot_cap', snd (extras ! Suc 0))) None)
odE) (case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extras' of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cap') >>= slotCapLongRunningDelete;
whenE (\<not> (canChangeCRoot \<and> canChangeVRoot)) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cap') (cte_map slot) (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) proof (prove)
goal:
No subgoals!