theory Tcb_DR

lemma decode_set_space_translate_tcb_invocation:
  "\<And>s. \<lbrace>(=) s\<rbrace> decode_set_space x (cap.ThreadCap t) slot' (excaps')
    \<lbrace>\<lambda>rv s'. s' = s \<and>
    (rv =  tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None) \<and>
    (tc_new_fault_ep rv = Some (to_bl (x!0)))
    \<and> (option_map (\<lambda>c. snd c)  (tc_new_croot rv) = Some (snd (excaps' ! 0)))
    \<and> (option_map (\<lambda>c. snd c)  (tc_new_vroot rv) = Some (snd (excaps' ! Suc 0)))
    \<and> (option_map (\<lambda>c. fst c ) (tc_new_croot rv)
        = (if (x!1 = 0) then Some (fst (excaps' ! 0)) else Some (update_cap_data False (x ! Suc 0) (fst (excaps' ! 0)))))
    \<and> (option_map (\<lambda>c. fst c)  (tc_new_vroot rv) = Some (fst (excaps' ! Suc 0)))
    \<and> (option_map (\<lambda>c. is_cnode_cap (fst c)) (tc_new_croot rv) = Some True)
    \<rbrace>,\<lbrace>\<lambda>rv. (=) s\<rbrace>" supply if_cong[cong] apply (case_tac "excaps' ! 0") apply (case_tac "excaps' ! Suc 0") apply (clarsimp simp:decode_set_space_def whenE_def | rule conjI)+ apply wp apply (clarsimp simp: | rule conjI)+ apply (wp|clarsimp)+ apply (rule_tac P ="croot_cap' = a \<and> is_cnode_cap a" in hoare_gen_asmE) apply clarsimp apply (rule validE_validE_R) apply (wp hoare_post_impErr[OF derive_cnode_cap_as_vroot],simp) apply (wp|clarsimp)+ apply (wp hoare_post_impErr[OF derive_cnode_cap_as_croot],simp) apply (wp|clarsimp)+ apply (clarsimp simp:whenE_def | rule conjI | wp)+ apply (rule_tac P ="croot_cap' = update_cap_data False (x! 1) a \<and> is_cnode_cap croot_cap'" in hoare_gen_asmE) apply (rule validE_validE_R) apply simp apply (rule_tac s1 = s in hoare_post_impErr[OF derive_cnode_cap_as_vroot],simp) apply (rule conjI|simp split:if_split_asm)+ apply (wp|clarsimp)+ apply (rule validE_validE_R) apply (rule_tac s1 = s in hoare_post_impErr[OF derive_cnode_cap_as_croot]) apply (wp|clarsimp)+ apply (clarsimp simp:whenE_def | rule conjI | wp)+ apply (rule_tac P ="croot_cap' = a \<and> is_cnode_cap a" in hoare_gen_asmE) apply clarsimp apply (rule validE_validE_R) apply (rule_tac s1 = s in hoare_post_impErr[OF derive_cnode_cap_as_vroot],simp) apply (clarsimp split:if_splits simp:valid_vtable_root_update) apply (wp|clarsimp)+ apply (wp hoare_post_impErr[OF derive_cnode_cap_as_croot],simp) apply (wp|clarsimp)+ apply (clarsimp simp: | rule conjI | wp)+ apply (rule_tac P ="croot_cap' = update_cap_data False (x! 1) a \<and> is_cnode_cap croot_cap'" in hoare_gen_asmE) apply (rule validE_validE_R) apply simp apply (rule_tac s1 = s in hoare_post_impErr[OF derive_cnode_cap_as_vroot],simp) apply (rule conjI|simp split:if_split_asm)+ apply (rule valid_vtable_root_update) apply clarsimp+ apply (wp|clarsimp)+ apply (rule validE_validE_R) apply (rule hoare_post_impErr[OF derive_cnode_cap_as_croot]) apply fastforce+ apply (wp|clarsimp)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrace>(=) s\<rbrace> decode_set_space x (ThreadCap t) slot' excaps' \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> map_option snd (tc_new_croot rv) = Some (snd (excaps' ! 0)) \<and> map_option snd (tc_new_vroot rv) = Some (snd (excaps' ! Suc 0)) \<and> map_option fst (tc_new_croot rv) = (if x ! 1 = 0 then Some (fst (excaps' ! 0)) else Some (CSpace_A.update_cap_data False (x ! Suc 0) (fst (excaps' ! 0)))) \<and> map_option fst (tc_new_vroot rv) = Some (fst (excaps' ! Suc 0)) \<and> map_option (\<lambda>c. Structures_A.is_cnode_cap (fst c)) (tc_new_croot rv) = Some True\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrace>(=) s\<rbrace> decode_set_space x (ThreadCap t) slot' excaps' \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> map_option snd (tc_new_croot rv) = Some (snd (excaps' ! 0)) \<and> map_option snd (tc_new_vroot rv) = Some (snd (excaps' ! Suc 0)) \<and> map_option fst (tc_new_croot rv) = (if x ! 1 = 0 then Some (fst (excaps' ! 0)) else Some (CSpace_A.update_cap_data False (x ! Suc 0) (fst (excaps' ! 0)))) \<and> map_option fst (tc_new_vroot rv) = Some (fst (excaps' ! Suc 0)) \<and> map_option (\<lambda>c. Structures_A.is_cnode_cap (fst c)) (tc_new_croot rv) = Some True\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s a b c. excaps' ! 0 = (a, b, c) \<Longrightarrow> \<lbrace>(=) s\<rbrace> decode_set_space x (ThreadCap t) slot' excaps' \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> map_option snd (tc_new_croot rv) = Some (snd (excaps' ! 0)) \<and> map_option snd (tc_new_vroot rv) = Some (snd (excaps' ! Suc 0)) \<and> map_option fst (tc_new_croot rv) = (if x ! 1 = 0 then Some (fst (excaps' ! 0)) else Some (CSpace_A.update_cap_data False (x ! Suc 0) (fst (excaps' ! 0)))) \<and> map_option fst (tc_new_vroot rv) = Some (fst (excaps' ! Suc 0)) \<and> map_option (\<lambda>c. Structures_A.is_cnode_cap (fst c)) (tc_new_croot rv) = Some True\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> decode_set_space x (ThreadCap t) slot' excaps' \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> map_option snd (tc_new_croot rv) = Some (snd (excaps' ! 0)) \<and> map_option snd (tc_new_vroot rv) = Some (snd (excaps' ! Suc 0)) \<and> map_option fst (tc_new_croot rv) = (if x ! 1 = 0 then Some (fst (excaps' ! 0)) else Some (CSpace_A.update_cap_data False (x ! Suc 0) (fst (excaps' ! 0)))) \<and> map_option fst (tc_new_vroot rv) = Some (fst (excaps' ! Suc 0)) \<and> map_option (\<lambda>c. Structures_A.is_cnode_cap (fst c)) (tc_new_croot rv) = Some True\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; length x < 3\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 2. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0\<rbrakk> \<Longrightarrow> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 3. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 4. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (3 subgoals):
 1. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0\<rbrakk> \<Longrightarrow> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 2. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 3. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (4 subgoals):
 1. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 2. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0\<rbrakk> \<Longrightarrow> \<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 4. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (9 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?P'75 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap' ()\<rbrace> CSpace_A.derive_cap (ba, ca) aa \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>b. b = s \<and> croot_cap' = a \<and> vroot_cap' = aa \<and> Structures_A.is_cnode_cap croot_cap' else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B65 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> ?P'75 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B64 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B65 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B63 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B64 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B62 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B63 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q61 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B62 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q61 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 9. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (9 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; croot_cap' = a \<and> Structures_A.is_cnode_cap a\<rbrakk> \<Longrightarrow> \<lbrace>?P'84 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap' ()\<rbrace> CSpace_A.derive_cap (ba, ca) aa \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>b. b = s \<and> croot_cap' = a \<and> vroot_cap' = aa \<and> Structures_A.is_cnode_cap croot_cap' else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B65 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'84 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = a \<and> Structures_A.is_cnode_cap a)) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B64 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B65 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B63 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B64 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B62 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B63 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q61 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B62 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q61 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 9. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (9 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap a\<rbrakk> \<Longrightarrow> \<lbrace>?P'84 s a b c aa ba ca can_chg_cr can_chg_vr () a ()\<rbrace> CSpace_A.derive_cap (ba, ca) aa \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>a. a = s \<and> vroot_cap' = aa else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B65 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'84 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = a \<and> Structures_A.is_cnode_cap a)) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B64 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B65 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B63 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B64 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B62 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B63 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q61 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B62 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q61 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 9. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (9 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap a\<rbrakk> \<Longrightarrow> \<lbrace>?P'84 s a b c aa ba ca can_chg_cr can_chg_vr () a ()\<rbrace> CSpace_A.derive_cap (ba, ca) aa \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>a. a = s \<and> vroot_cap' = aa else (=) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B65 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'84 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = a \<and> Structures_A.is_cnode_cap a)) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B64 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B65 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B63 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B64 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B62 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B63 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q61 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B62 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q61 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 9. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B65 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> croot_cap' = a \<and> Structures_A.is_cnode_cap a\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B64 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B65 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B63 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B64 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B62 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B63 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q61 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B62 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q61 s a b c aa ba ca sa
 7. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (7 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?P'111 s a b c aa ba ca can_chg_cr can_chg_vr ()\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>\<lambda>b. if Structures_A.is_cnode_cap b then \<lambda>sa. s = sa \<and> b = a \<and> Structures_A.is_cnode_cap a else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B63 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y sa. s = sa \<and> ?P'111 s a b c aa ba ca can_chg_cr can_chg_vr y sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B62 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B63 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q61 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B62 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q61 s a b c aa ba ca sa
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 7. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (6 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B63 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y. (=) s\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B62 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B63 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q61 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B62 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q61 s a b c aa ba ca sa
 5. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (2 subgoals):
 1. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0\<rbrakk> \<Longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) aa;
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)
 2. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?P'200 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap' ()\<rbrace> CSpace_A.derive_cap (ba, ca) aa \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>b. b = s \<and> croot_cap' = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> vroot_cap' = aa \<and> Structures_A.is_cnode_cap croot_cap' else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> ?P'200 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B188 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B187 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B188 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B187 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q186 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'209 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap' ()\<rbrace> CSpace_A.derive_cap (ba, ca) aa \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>b. b = s \<and> croot_cap' = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> vroot_cap' = aa \<and> Structures_A.is_cnode_cap croot_cap' else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'209 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap')) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B188 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B187 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B188 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B187 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q186 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'209 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap' ()\<rbrace> CSpace_A.derive_cap (ba, ca) aa \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>b. b = s \<and> croot_cap' = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> vroot_cap' = aa \<and> Structures_A.is_cnode_cap croot_cap' else (=) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'209 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap')) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B188 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B187 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B188 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B187 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q186 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'209 s a b c aa ba ca can_chg_cr can_chg_vr () (CSpace_A.update_cap_data False (x ! Suc 0) a) ()\<rbrace> CSpace_A.derive_cap (ba, ca) aa \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>a. a = s \<and> vroot_cap' = aa else (=) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'209 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap')) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B188 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B187 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B188 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B187 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q186 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr e sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a); s = sa\<rbrakk> \<Longrightarrow> True
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> ((=) s and K (croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap')) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B188 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B187 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B188 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B187 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q186 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (7 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> croot_cap' = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> Structures_A.is_cnode_cap croot_cap'\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B190 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B188 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B189 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B187 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B188 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B187 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q186 s a b c aa ba ca sa
 7. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (6 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?P'231 s a b c aa ba ca can_chg_cr can_chg_vr ()\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>\<lambda>b. if Structures_A.is_cnode_cap b then \<lambda>sa. s = sa \<and> b = CSpace_A.update_cap_data False (x ! Suc 0) a else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B188 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y sa. s = sa \<and> ?P'231 s a b c aa ba ca can_chg_cr can_chg_vr y sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B187 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B188 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B187 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q186 s a b c aa ba ca sa
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (6 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?P'231 s a b c aa ba ca can_chg_cr can_chg_vr ()\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>\<lambda>b. if Structures_A.is_cnode_cap b then \<lambda>sa. s = sa \<and> b = CSpace_A.update_cap_data False (x ! Suc 0) a else (=) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B188 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y sa. s = sa \<and> ?P'231 s a b c aa ba ca can_chg_cr can_chg_vr y sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B187 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B188 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B187 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q186 s a b c aa ba ca sa
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (7 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr rv sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; (if Structures_A.is_cnode_cap rv then \<lambda>sa. s = sa \<and> rv = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a) else (=) s) sa\<rbrakk> \<Longrightarrow> (if Structures_A.is_cnode_cap rv then \<lambda>sa. s = sa \<and> rv = CSpace_A.update_cap_data False (x ! Suc 0) a else (=) s) sa
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr e sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> True
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B188 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y sa. s = sa \<and> s = sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B187 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B188 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B187 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q186 s a b c aa ba ca sa
 7. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (7 subgoals):
 1. \<And>s a b c aa ba ca rv sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; (if Structures_A.is_cnode_cap rv then \<lambda>sa. s = sa \<and> rv = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a) else (=) s) sa\<rbrakk> \<Longrightarrow> (Structures_A.is_cnode_cap rv \<longrightarrow> s = sa \<and> rv = CSpace_A.update_cap_data False (x ! Suc 0) a) \<and> (\<not> Structures_A.is_cnode_cap rv \<longrightarrow> s = sa)
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr e sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> True
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B188 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y sa. s = sa \<and> s = sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B187 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B188 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q186 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B187 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 = 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q186 s a b c aa ba ca sa
 7. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> x ! 2 \<noteq> 0 \<longrightarrow> (x ! Suc 0 = 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) a;
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) \<and> (x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>)) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?P'340 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap' ()\<rbrace> CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa) \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>b. b = s \<and> croot_cap' = a \<and> vroot_cap' = aa \<and> Structures_A.is_cnode_cap croot_cap' else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> ?P'340 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B328 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B327 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B328 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q326 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B327 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q326 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; croot_cap' = a \<and> Structures_A.is_cnode_cap a\<rbrakk> \<Longrightarrow> \<lbrace>?P'349 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap' ()\<rbrace> CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa) \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>b. b = s \<and> croot_cap' = a \<and> vroot_cap' = aa \<and> Structures_A.is_cnode_cap croot_cap' else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'349 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = a \<and> Structures_A.is_cnode_cap a)) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B328 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B327 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B328 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q326 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B327 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q326 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap a\<rbrakk> \<Longrightarrow> \<lbrace>?P'349 s a b c aa ba ca can_chg_cr can_chg_vr () a ()\<rbrace> CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa) \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>a. a = s \<and> vroot_cap' = aa else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'349 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = a \<and> Structures_A.is_cnode_cap a)) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B328 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B327 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B328 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q326 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B327 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q326 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap a\<rbrakk> \<Longrightarrow> \<lbrace>?P'349 s a b c aa ba ca can_chg_cr can_chg_vr () a ()\<rbrace> CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa) \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>a. a = s \<and> vroot_cap' = aa else (=) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'349 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = a \<and> Structures_A.is_cnode_cap a)) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B328 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B327 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B328 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q326 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B327 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q326 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) proof (prove)
goal (9 subgoals):
 1. \<And>s a b c aa ba ca rv sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap a; (if is_valid_vtable_root rv then \<lambda>sa. sa = s \<and> rv = CSpace_A.update_cap_data False (x ! 2) aa else (=) s) sa\<rbrakk> \<Longrightarrow> (is_valid_vtable_root rv \<longrightarrow> sa = s \<and> rv = aa) \<and> (\<not> is_valid_vtable_root rv \<longrightarrow> s = sa)
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr e sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap a; s = sa\<rbrakk> \<Longrightarrow> True
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> ((=) s and K (croot_cap' = a \<and> Structures_A.is_cnode_cap a)) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B328 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B327 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B328 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q326 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B327 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 8. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q326 s a b c aa ba ca sa
 9. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr e sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap a; s = sa\<rbrakk> \<Longrightarrow> True
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> ((=) s and K (croot_cap' = a \<and> Structures_A.is_cnode_cap a)) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>?B330 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B328 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B329 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B327 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B328 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q326 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B327 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q326 s a b c aa ba ca sa
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) proof (prove)
goal (6 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?P'385 s a b c aa ba ca can_chg_cr can_chg_vr ()\<rbrace> CSpace_A.derive_cap (b, c) a \<lbrace>\<lambda>croot_cap'. if Structures_A.is_cnode_cap croot_cap' then \<lambda>sa. s = sa \<and> croot_cap' = a \<and> Structures_A.is_cnode_cap a else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B328 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y sa. s = sa \<and> ?P'385 s a b c aa ba ca can_chg_cr can_chg_vr y sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B327 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B328 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q326 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B327 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q326 s a b c aa ba ca sa
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) proof (prove)
goal (5 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B328 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y. (=) s\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B327 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B328 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q326 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B327 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 = 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q326 s a b c aa ba ca sa
 5. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0\<rbrakk> \<Longrightarrow> x ! Suc 0 \<noteq> 0 \<longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) proof (prove)
goal (1 subgoal):
 1. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0\<rbrakk> \<Longrightarrow> (length x < 3 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> throwError TruncatedMessage \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) \<and> (\<not> length x < 3 \<and> \<not> length excaps' < 2 \<longrightarrow> \<lbrace>(=) s\<rbrace> doE can_chg_cr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t)));
can_chg_vr <- liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t)));
y <- unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation);
croot_cap' <- CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a);
y <- unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation);
vroot_cap' <- CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa);
y <- unlessE (is_valid_vtable_root vroot_cap') (throwError IllegalOperation);
returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (x ! 0))) None None (Some (croot_cap', b, c)) (Some (vroot_cap', ba, ca)) None)
odE \<lbrace>\<lambda>rv s'. s' = s \<and> rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (x ! 0)) \<and> (\<exists>a. tc_new_croot rv = Some (a, b, c)) \<and> (\<exists>a. tc_new_vroot rv = Some (a, ba, ca)) \<and> (\<exists>aa b. tc_new_croot rv = Some (CSpace_A.update_cap_data False (x ! Suc 0) a, aa, b)) \<and> (\<exists>a b. tc_new_vroot rv = Some (aa, a, b)) \<and> (\<exists>a. (\<exists>aa b. tc_new_croot rv = Some (a, aa, b)) \<and> Structures_A.is_cnode_cap a)\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>) proof (prove)
goal (7 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?P'469 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap' ()\<rbrace> CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa) \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>b. b = s \<and> croot_cap' = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> vroot_cap' = aa \<and> Structures_A.is_cnode_cap croot_cap' else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> ?P'469 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (7 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'478 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap' ()\<rbrace> CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa) \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>b. b = s \<and> croot_cap' = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> vroot_cap' = aa \<and> Structures_A.is_cnode_cap croot_cap' else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'478 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap')) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (7 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'478 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap' ()\<rbrace> CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa) \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>b. b = s \<and> croot_cap' = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> vroot_cap' = aa \<and> Structures_A.is_cnode_cap croot_cap' else (=) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'478 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap')) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (7 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'478 s a b c aa ba ca can_chg_cr can_chg_vr () (CSpace_A.update_cap_data False (x ! Suc 0) a) ()\<rbrace> CSpace_A.derive_cap (ba, ca) (CSpace_A.update_cap_data False (x ! 2) aa) \<lbrace>\<lambda>vroot_cap'. if is_valid_vtable_root vroot_cap' then \<lambda>a. a = s \<and> vroot_cap' = aa else (=) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> (?P'478 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap' ya and K (croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap')) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (8 subgoals):
 1. \<And>s a b c aa ba ca rv sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a); (if is_valid_vtable_root rv then \<lambda>sa. sa = s \<and> rv = CSpace_A.update_cap_data False (x ! 2) aa else (=) s) sa\<rbrakk> \<Longrightarrow> (is_valid_vtable_root rv \<longrightarrow> sa = s \<and> rv = aa) \<and> (\<not> is_valid_vtable_root rv \<longrightarrow> s = sa)
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr e sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a); s = sa\<rbrakk> \<Longrightarrow> True
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> ((=) s and K (croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap')) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 8. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (9 subgoals):
 1. \<And>a b c aa ba ca rv. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a); is_valid_vtable_root (CSpace_A.update_cap_data False (x ! 2) aa); rv = CSpace_A.update_cap_data False (x ! 2) aa\<rbrakk> \<Longrightarrow> CSpace_A.update_cap_data False (x ! 2) aa = aa
 2. \<And>s a b c aa ba ca rv sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a); (if is_valid_vtable_root rv then \<lambda>sa. sa = s \<and> rv = CSpace_A.update_cap_data False (x ! 2) aa else (=) s) sa\<rbrakk> \<Longrightarrow> \<not> is_valid_vtable_root rv \<longrightarrow> s = sa
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr e sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a); s = sa\<rbrakk> \<Longrightarrow> True
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> ((=) s and K (croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap')) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 9. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (9 subgoals):
 1. \<And>a b c aa ba ca rv. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a); is_valid_vtable_root (CSpace_A.update_cap_data False (x ! 2) aa); rv = CSpace_A.update_cap_data False (x ! 2) aa\<rbrakk> \<Longrightarrow> is_valid_vtable_root (CSpace_A.update_cap_data False (x ! 2) aa)
 2. \<And>s a b c aa ba ca rv sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a); (if is_valid_vtable_root rv then \<lambda>sa. sa = s \<and> rv = CSpace_A.update_cap_data False (x ! 2) aa else (=) s) sa\<rbrakk> \<Longrightarrow> \<not> is_valid_vtable_root rv \<longrightarrow> s = sa
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr e sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a); s = sa\<rbrakk> \<Longrightarrow> True
 4. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> ((=) s and K (croot_cap' = CSpace_A.update_cap_data False (x ! 1) a \<and> Structures_A.is_cnode_cap croot_cap')) sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 7. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 8. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 9. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (6 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr croot_cap'. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr () croot_cap'\<rbrace> unlessE (Structures_A.is_cnode_cap croot_cap') (throwError IllegalOperation) \<lbrace>\<lambda>ya sa. s = sa \<and> croot_cap' = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> Structures_A.is_cnode_cap croot_cap'\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr y. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>?B459 s a b c aa ba ca can_chg_cr can_chg_vr y\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>?B458 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (5 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?P'525 s a b c aa ba ca can_chg_cr can_chg_vr ()\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>\<lambda>b. if Structures_A.is_cnode_cap b then \<lambda>sa. s = sa \<and> b = CSpace_A.update_cap_data False (x ! Suc 0) a else (=) s\<rbrace>, -
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y sa. s = sa \<and> ?P'525 s a b c aa ba ca can_chg_cr can_chg_vr y sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (5 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?P'525 s a b c aa ba ca can_chg_cr can_chg_vr ()\<rbrace> CSpace_A.derive_cap (b, c) (CSpace_A.update_cap_data False (x ! Suc 0) a) \<lbrace>\<lambda>b. if Structures_A.is_cnode_cap b then \<lambda>sa. s = sa \<and> b = CSpace_A.update_cap_data False (x ! Suc 0) a else (=) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y sa. s = sa \<and> ?P'525 s a b c aa ba ca can_chg_cr can_chg_vr y sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (6 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr rv sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; (if Structures_A.is_cnode_cap rv then \<lambda>sa. ?s537 s a b c aa ba ca can_chg_cr can_chg_vr () = sa \<and> rv = CSpace_A.update_cap_data False (x ! Suc 0) a \<and> Structures_A.is_cnode_cap (CSpace_A.update_cap_data False (x ! Suc 0) a) else (=) (?s537 s a b c aa ba ca can_chg_cr can_chg_vr ())) sa\<rbrakk> \<Longrightarrow> (if Structures_A.is_cnode_cap rv then \<lambda>sa. s = sa \<and> rv = CSpace_A.update_cap_data False (x ! Suc 0) a else (=) s) sa
 2. \<And>s a b c aa ba ca can_chg_cr can_chg_vr e sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; ?s537 s a b c aa ba ca can_chg_cr can_chg_vr () = sa\<rbrakk> \<Longrightarrow> True
 3. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y sa. s = sa \<and> ?s537 s a b c aa ba ca can_chg_cr can_chg_vr y = sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 5. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 6. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal (4 subgoals):
 1. \<And>s a b c aa ba ca can_chg_cr can_chg_vr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B457 s a b c aa ba ca can_chg_cr can_chg_vr\<rbrace> unlessE (can_chg_cr \<and> can_chg_vr) (throwError IllegalOperation) \<lbrace>\<lambda>y sa. s = sa \<and> s = sa\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 2. \<And>s a b c aa ba ca can_chg_cr. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?B456 s a b c aa ba ca can_chg_cr\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_vtable_ptr t))) \<lbrace>?B457 s a b c aa ba ca can_chg_cr\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 3. \<And>s a b c aa ba ca. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2\<rbrakk> \<Longrightarrow> \<lbrace>?Q455 s a b c aa ba ca\<rbrace> liftE (liftM Not (slot_cap_long_running_delete (get_tcb_ctable_ptr t))) \<lbrace>?B456 s a b c aa ba ca\<rbrace>, \<lbrace>\<lambda>rv. (=) s\<rbrace>
 4. \<And>s a b c aa ba ca sa. \<lbrakk>excaps' ! 0 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); x ! 2 \<noteq> 0; x ! Suc 0 \<noteq> 0; \<not> length x < 3; \<not> length excaps' < 2; s = sa\<rbrakk> \<Longrightarrow> ?Q455 s a b c aa ba ca sa proof (prove)
goal:
No subgoals!