theory CSpace_All

lemma lookupSlotForCNodeOp_ccorres':
  "ccorres
   (syscall_error_rel \<currency>  (\<lambda>w w'. w'= Ptr w \<and> depth \<le> word_bits)) lookupSlot_xf
   (\<lambda>s.  valid_pspace' s \<and> s  \<turnstile>' croot \<and> depth < 2 ^ word_bits)
   (UNIV \<inter> {s. capptr_' s = capptr} \<inter>
            {s. to_bool (isSource_' s) = isSource}  \<inter>
            {s. ccap_relation croot (root_' s)} \<inter>
            {s. depth_' s = of_nat depth} ) []
  (lookupSlotForCNodeOp isSource croot capptr depth)
  (Call lookupSlotForCNodeOp_'proc)" apply (cinit lift: capptr_' isSource_' root_' depth_') apply csymbr \<comment> \<open>slot_C_update\<close> apply csymbr \<comment> \<open>cap_get_capType\<close> apply (rule_tac Q=\<top> and Q'=\<top> in ccorres_if_cond_throws2)
      \<comment> \<open>correspondance of Haskell and C conditions\<close> apply (clarsimp simp: Collect_const_mem cap_get_tag_isCap)

     \<comment> \<open>case where root is *not* a CNode => throw InvalidRoot\<close> apply simp apply (rule_tac P=\<top> and P' =UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def  return_def syscall_error_rel_def) apply (clarsimp simp: EXCEPTION_NONE_def EXCEPTION_SYSCALL_ERROR_def) apply (drule_tac  lookup_fault_lift_invalid_root) apply clarsimp apply (subst syscall_error_to_H_cases(6), simp+)[1]

    \<comment> \<open>case where root is a CNode\<close> apply (simp add: rangeCheck_def) apply csymbr apply (rule ccorres_Cond_rhs_Seq) apply (rule_tac P="depth < 2 ^ word_bits" in ccorres_gen_asm) apply (drule unat_of_nat32) apply (simp add: if_1_0_0 unlessE_def fromIntegral_def integral_inv) apply (rule ccorres_cond_true_seq) apply (rule ccorres_split_throws) apply (rule_tac P= \<top> and P' =UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def  return_def syscall_error_rel_def
                            word_sle_def syscall_error_to_H_cases
                            word_size exception_defs) apply vcg apply csymbr apply (rule_tac Q="\<lambda>s. depth < 2 ^ word_bits" and Q'=\<top> in ccorres_split_unless_throwError_cond)
       \<comment> \<open>correspondance of Haskell and C conditions\<close> apply (clarsimp simp: Collect_const_mem fromIntegral_def integral_inv
                             if_1_0_0) apply (simp add: word_size unat_of_nat32 word_less_nat_alt
                        word_less_1[symmetric] linorder_not_le)

      \<comment> \<open>case of RangeError\<close> apply (rule_tac P= \<top> and P' =UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def  return_def syscall_error_rel_def) apply (clarsimp simp: EXCEPTION_NONE_def EXCEPTION_SYSCALL_ERROR_def) apply (subst syscall_error_to_H_cases(4), simp+)[1] apply (simp add: word_size word_sle_def)

     \<comment> \<open>case where there is *no* RangeError\<close> apply (rule_tac xf'=lookupSlot_xf in  ccorres_rel_imp) apply (rule_tac r="\<lambda>w w'. w'= Ptr w"
          and f="\<lambda> st fl es. fl = scast EXCEPTION_SYSCALL_ERROR \<and>
                           syscall_error_to_H (errsyscall es) (errlookup_fault es) = Some (FailedLookup isSource st)"
          in lookupErrorOnFailure_ccorres) apply (ctac (no_vcg))  \<comment> \<open>resolveAddressBits\<close>
        \<comment> \<open>case where resolveAddressBits results in EXCEPTION_NONE\<close> apply clarsimp apply (rule_tac A=\<top> and A'=UNIV in ccorres_guard_imp2) apply (rule_tac Q=\<top> and Q'=\<top> in ccorres_if_cond_throws2)
            \<comment> \<open>correspondance of Haskell and C conditions\<close> apply (clarsimp simp: Collect_const_mem unat_gt_0)
           \<comment> \<open>case where bits are remaining\<close> apply (rule_tac P= \<top> and P' =UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def) apply (clarsimp simp: EXCEPTION_NONE_def EXCEPTION_SYSCALL_ERROR_def) apply (subst syscall_error_to_H_cases(6), simp+)[1] apply (simp add: lookup_fault_depth_mismatch_lift) apply (erule le_32_mask_eq)

          \<comment> \<open>case where *no* bits are remaining\<close> apply csymbr \<comment> \<open>slot_C_update\<close> apply csymbr \<comment> \<open>status_C_update\<close> apply (rule ccorres_return_CE, simp+)[1] apply vcg

        \<comment> \<open>guard_imp subgoal\<close> apply clarsimp

       \<comment> \<open>case where resolveAddressBits does *not* results in EXCEPTION_NONE\<close> apply clarsimp apply (rule_tac P= \<top> and P' ="\<lbrace>\<exists>v. (lookup_fault_lift (\<acute>current_lookup_fault)) = Some v
                                              \<and> lookup_fault_to_H v = err \<rbrace>"
                       in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def) apply (clarsimp simp: EXCEPTION_NONE_def EXCEPTION_SYSCALL_ERROR_def) apply (subst syscall_error_to_H_cases(6), simp+)[1] apply wp

     \<comment> \<open>rel_imp\<close> apply clarsimp apply (case_tac x, clarsimp) apply (simp add: syscall_error_rel_def errstate_def) apply (clarsimp simp: word_bits_def word_size fromIntegral_def
                           integral_inv) apply vcg apply vcg

  \<comment> \<open>last subgoal\<close> apply (clarsimp simp: word_size fromIntegral_def integral_inv) apply (case_tac "cap_get_tag root = scast cap_cnode_cap") prefer 2 apply clarsimp apply (clarsimp simp: unat_of_nat32 word_sle_def) apply (simp add: Collect_const_mem lookup_failure_rel_fault_lift) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (\<lambda>s. valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits) (UNIV \<inter> \<lbrace>\<acute>capptr = capptr\<rbrace> \<inter> \<lbrace>to_bool \<acute>isSource = isSource\<rbrace> \<inter> \<lbrace>ccap_relation croot \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat depth\<rbrace>) [] (lookupSlotForCNodeOp isSource croot capptr depth) (Call lookupSlotForCNodeOp_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>deptha root isSourcea capptra. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?Q3128 deptha root isSourcea capptra) (?Q'3128 deptha root isSourcea capptra) [SKIP] (if isCNodeCap croot then doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE else throw $ Fault_H.syscall_error.FailedLookup isSource Fault_H.lookup_failure.InvalidRoot) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) \<acute>ret___struct_lookupSlot_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(root);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) \<acute>ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))))))
 2. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3128 deptha root isSourcea capptra s \<and> s' \<in> ?Q'3128 deptha root isSourcea capptra proof (prove)
goal (2 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?Q3128 deptha root isSourcea capptra) (?G'3259 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C) [SKIP] (if isCNodeCap croot then doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE else throw $ Fault_H.syscall_error.FailedLookup isSource Fault_H.lookup_failure.InvalidRoot) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(root);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))))
 2. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3128 deptha root isSourcea capptra s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> ?G'3259 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s)}} proof (prove)
goal (2 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?Q3128 deptha root isSourcea capptra) (?G'3773 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (if isCNodeCap croot then doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE else throw $ Fault_H.syscall_error.FailedLookup isSource Fault_H.lookup_failure.InvalidRoot) (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))))
 2. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3128 deptha root isSourcea capptra s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'3773 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v}}} proof (prove)
goal (5 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> isCNodeCap croot) = (s' \<in> \<lbrace>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace>)
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; \<not> isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4321 deptha root isSourcea capptra) (?R'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (throw $ Fault_H.syscall_error.FailedLookup isSource Fault_H.lookup_failure.InvalidRoot) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 deptha root isSourcea capptra) (?U'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE) (\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> ?R4321 deptha root isSourcea capptra s) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?R'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; \<not> isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4321 deptha root isSourcea capptra) (?R'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (throw $ Fault_H.syscall_error.FailedLookup isSource Fault_H.lookup_failure.InvalidRoot) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 deptha root isSourcea capptra) (?U'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE) (\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> ?R4321 deptha root isSourcea capptra s) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?R'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; \<not> isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4321 (word_of_nat depth) root isSourcea capptr) (?R'4318 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (throwError (Fault_H.syscall_error.FailedLookup isSource Fault_H.lookup_failure.InvalidRoot)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 deptha root isSourcea capptra) (?U'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE) (\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> ?R4321 deptha root isSourcea capptra s) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?R'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; \<not> isCNodeCap croot\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Fault_H.syscall_error.FailedLookup isSource Fault_H.lookup_failure.InvalidRoot) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) rv (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' s)}
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 deptha root isSourcea capptra) (?U'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE) (\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned \<sigma>. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; \<not> isCNodeCap croot\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (throwError (Fault_H.syscall_error.FailedLookup isSource Fault_H.lookup_failure.InvalidRoot) \<sigma>). (\<sigma>', globals_update (\<lambda>x. x\<lparr>current_syscall_error_' := failedLookupWasSource_C_update (\<lambda>_. isSourcea) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (current_syscall_error_' (globals s))), current_lookup_fault_' := ret__struct_lookup_fault_C_' t\<rparr>) s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), ret__struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) rv (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' (globals_update (\<lambda>x. x\<lparr>current_syscall_error_' := failedLookupWasSource_C_update (\<lambda>_. isSourcea) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (current_syscall_error_' (globals s))), current_lookup_fault_' := ret__struct_lookup_fault_C_' t\<rparr>) s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), ret__struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), global_exn_var_' := Return\<rparr>)))}
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 deptha root isSourcea capptra) (?U'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE) (\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (4 subgoals):
 1. \<And>root isSourcea \<sigma> x t. \<lbrakk>ccap_relation croot root; \<not> isCNodeCap croot; isSource = to_bool isSourcea; (\<sigma>, x) \<in> rf_sr; lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root\<rbrakk> \<Longrightarrow> EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE \<and> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (failedLookupWasSource_C_update (\<lambda>_. isSourcea) (current_syscall_error_' (globals x)))) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) Fault_H.lookup_failure.InvalidRoot)
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 deptha root isSourcea capptra) (?U'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE) (\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (4 subgoals):
 1. \<And>root isSourcea \<sigma> x t. \<lbrakk>ccap_relation croot root; \<not> isCNodeCap croot; isSource = to_bool isSourcea; (\<sigma>, x) \<in> rf_sr; lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (failedLookupWasSource_C_update (\<lambda>_. isSourcea) (current_syscall_error_' (globals x)))) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) Fault_H.lookup_failure.InvalidRoot)
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 deptha root isSourcea capptra) (?U'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE) (\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (4 subgoals):
 1. \<And>root isSourcea \<sigma> x t. \<lbrakk>ccap_relation croot root; \<not> isCNodeCap croot; isSource = to_bool isSourcea; (\<sigma>, x) \<in> rf_sr; lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some Lookup_fault_invalid_root\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (failedLookupWasSource_C_update (\<lambda>_. isSourcea) (current_syscall_error_' (globals x)))) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) Fault_H.lookup_failure.InvalidRoot)
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 deptha root isSourcea capptra) (?U'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE) (\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (4 subgoals):
 1. \<And>root isSourcea \<sigma> x t. \<lbrakk>ccap_relation croot root; \<not> isCNodeCap croot; isSource = to_bool isSourcea; (\<sigma>, x) \<in> rf_sr; lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some Lookup_fault_invalid_root\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (failedLookupWasSource_C_update (\<lambda>_. isSourcea) (current_syscall_error_' (globals x)))) (Some Lookup_fault_invalid_root) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) Fault_H.lookup_failure.InvalidRoot)
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 deptha root isSourcea capptra) (?U'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE) (\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (3 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 deptha root isSourcea capptra) (?U'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) [SKIP] (doE rangeCheck depth 1 $ finiteBitSize capptr;
lookupErrorOnFailure isSource $ doE result <- CSpaceDecls_H.resolveAddressBits croot capptr depth;
let (slot, bitsLeft) = result in if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE
odE) (\<acute>ret__int :== (if deptha = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < deptha then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptra,deptha);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (bitsRemaining_C \<acute>res_ret));;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (3 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 (word_of_nat depth) root isSourcea capptr) (?U'4318 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if word_of_nat depth = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}}}} proof (prove)
goal (3 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U4323 (word_of_nat depth) root isSourcea capptr) (?G'4391 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (IF (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ?U4323 deptha root isSourcea capptra s)) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> ?G'4391 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v})}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?Q4513 (word_of_nat depth) root isSourcea capptr) (?S4516 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?T4514 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q4513 deptha root isSourcea capptra s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?S4516 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?T4514 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; depth < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?G4525 (word_of_nat depth) root isSourcea capptr) (?S4516 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?T4514 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (?G4525 deptha root isSourcea capptra and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?S4516 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?T4514 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; unat (word_of_nat depth) = depth\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?G4525 (word_of_nat depth) root isSourcea capptr) (?S4516 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?T4514 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (?G4525 deptha root isSourcea capptra and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?S4516 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?T4514 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = 0; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; depth = 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?G4525 0 root isSourcea capptr) (?S4516 0 root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr)))) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,0);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?T4514 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (?G4525 deptha root isSourcea capptra and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?S4516 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?T4514 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = 0; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; depth = 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?G4525 0 root isSourcea capptr) (?R'4543 0 root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr)))) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_';;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,0);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?T4514 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (?G4525 deptha root isSourcea capptra and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?R'4543 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?T4514 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = 0; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; depth = 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?G4525 0 root isSourcea capptr) (?P'4549 0 root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr)))) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = 0; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; depth = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4548 0 root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?T4514 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (?G4525 deptha root isSourcea capptra and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?P'4549 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> ?R'4548 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?T4514 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = 0; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; depth = 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) rv (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' s)}
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = 0; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; depth = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4548 0 root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?T4514 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'4548 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?T4514 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned \<sigma>. \<lbrakk>deptha = 0; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; depth = 0\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. rangeErrorMax_C_update (\<lambda>_. 0x20) (rangeErrorMin_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) (current_syscall_error_' (globals s)))))) s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), ret__struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) rv (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. rangeErrorMax_C_update (\<lambda>_. 0x20) (rangeErrorMin_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) (current_syscall_error_' (globals s)))))) s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), ret__struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), global_exn_var_' := Return\<rparr>))}
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = 0; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; depth = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4548 0 root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?T4514 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'4548 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?T4514 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = 0; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; depth = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4548 0 root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?T4514 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'4548 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?T4514 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}}}} proof (prove)
goal (3 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?T4514 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (\<acute>ret__int :== (if 0x20 < word_of_nat depth then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> ?T4514 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}}}} proof (prove)
goal (3 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R4512 (word_of_nat depth) root isSourcea capptr) (?G'4607 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE y <- unlessE (Suc 0 \<le> depth \<and> depth \<le> size capptr) (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))));
lookupErrorOnFailure isSource (doE (slot, bitsLeft) <- CSpace_H.resolveAddressBits croot capptr depth;
if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)
odE) (IF (if 0x20 < word_of_nat depth then 1 else 0) \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4512 deptha root isSourcea capptra s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> ?G'4607 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v})}})}}}} proof (prove)
goal (6 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> depth < 2 ^ word_bits \<and> True \<longrightarrow> (\<not> (Suc 0 \<le> depth \<and> depth \<le> size capptr)) = (s' \<in> \<lbrace>(if 0x20 < word_of_nat depth then 1 else 0) \<noteq> 0\<rbrace>)
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptr)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R5009 (word_of_nat depth) root isSourcea capptr) (?R'5005 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr)))) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (lookupErrorOnFailure isSource (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> ?R5009 deptha root isSourcea capptra s) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?R'5005 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (6 subgoals):
 1. \<And>root isSourcea s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; isSource = to_bool isSourcea; depth < 2 ^ word_bits; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (Suc 0 \<le> depth \<longrightarrow> \<not> depth \<le> size capptr) = (0x20 < word_of_nat depth)
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptr)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R5009 (word_of_nat depth) root isSourcea capptr) (?R'5005 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr)))) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (lookupErrorOnFailure isSource (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> ?R5009 deptha root isSourcea capptra s) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?R'5005 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptr)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R5009 (word_of_nat depth) root isSourcea capptr) (?R'5005 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr)))) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (lookupErrorOnFailure isSource (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> ?R5009 deptha root isSourcea capptra s) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?R'5005 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptr)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) rv (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' s)}
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (lookupErrorOnFailure isSource (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned \<sigma>. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptr)\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr))) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. rangeErrorMax_C_update (\<lambda>_. 0x20) (rangeErrorMin_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) (current_syscall_error_' (globals s)))))) s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), ret__struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) rv (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. rangeErrorMax_C_update (\<lambda>_. 0x20) (rangeErrorMin_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) (current_syscall_error_' (globals s)))))) s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), ret__struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), global_exn_var_' := Return\<rparr>))}
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (lookupErrorOnFailure isSource (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>root isSourcea \<sigma> x. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; Suc 0 \<le> depth \<longrightarrow> \<not> depth \<le> size capptr; isSource = to_bool isSourcea; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE \<and> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) (rangeErrorMax_C_update (\<lambda>_. 0x20) (rangeErrorMin_C_update (\<lambda>_. 1) (current_syscall_error_' (globals x))))) (lookup_fault_lift (current_lookup_fault_' (globals x))) = Some (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr)))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (lookupErrorOnFailure isSource (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>root isSourcea \<sigma> x. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; Suc 0 \<le> depth \<longrightarrow> \<not> depth \<le> size capptr; isSource = to_bool isSourcea; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) (rangeErrorMax_C_update (\<lambda>_. 0x20) (rangeErrorMin_C_update (\<lambda>_. 1) (current_syscall_error_' (globals x))))) (lookup_fault_lift (current_lookup_fault_' (globals x))) = Some (Fault_H.syscall_error.RangeError 1 (word_of_nat (size capptr)))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (lookupErrorOnFailure isSource (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>root isSourcea \<sigma> x. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; Suc 0 \<le> depth \<longrightarrow> \<not> depth \<le> size capptr; isSource = to_bool isSourcea; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> word_of_nat (size capptr) = 0x20
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (lookupErrorOnFailure isSource (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (lookupErrorOnFailure isSource (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres (?r'5063 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (lookupErrorOnFailure isSource (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE)) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ?r'5063 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>st fl es. fl = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall es) (errlookup_fault es) = Some (Fault_H.syscall_error.FailedLookup isSource st)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5007 (word_of_nat depth) root isSourcea capptr) (?U'5001 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) [SKIP] (doE a <- CSpace_H.resolveAddressBits croot capptr depth;
case a of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0
odE) (\<acute>res_ret :== CALL resolveAddressBits_'proc(root,capptr,word_of_nat depth);;
(IF resolveAddressBits_ret_C.status_C \<acute>res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C \<acute>res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C \<acute>res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C \<acute>res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> ?U5007 deptha root isSourcea capptra s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> ?U'5001 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v)}})}})}}}} proof (prove)
goal (7 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned rv res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; (case rv of (cte, bits) \<Rightarrow> \<lambda>(cte', bits'). cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C res_ret, bitsRemaining_C res_ret); resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a aa b. aa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall b) (errlookup_fault b) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a aa. aa = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?Q5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned rv) (?Q'5094 root isSourcea ret___struct_lookupSlot_ret_C rv res_ret) [SKIP] (case rv of (slot, bitsLeft) \<Rightarrow> if bitsLeft = 0 then returnOk slot else throw $ Fault_H.lookup_failure.DepthMismatch bitsLeft 0) (IF resolveAddressBits_ret_C.status_C res_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C res_ret \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C res_ret) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>?Q5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 7. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q'5093 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t rv)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t rv. ?Q'5094 root isSourcea ret___struct_lookupSlot_ret_C rv (ret__struct_resolveAddressBits_ret_C_' t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q'5093 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (7 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?Q5074 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) (a, unat (bitsRemaining_C res_ret))) (?Q'5094 root isSourcea ret___struct_lookupSlot_ret_C (a, unat (bitsRemaining_C res_ret)) res_ret) [SKIP] (if unat (bitsRemaining_C res_ret) = 0 then returnOk a else throw $ Fault_H.lookup_failure.DepthMismatch (unat (bitsRemaining_C res_ret)) 0) (Cond (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_') SKIP;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>?Q5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 7. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q'5093 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t rv)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t rv. ?Q'5094 root isSourcea ret___struct_lookupSlot_ret_C rv (ret__struct_resolveAddressBits_ret_C_' t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q'5093 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (8 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?Q5439 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?Q'5439 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (if unat (bitsRemaining_C res_ret) = 0 then returnOk a else throw $ Fault_H.lookup_failure.DepthMismatch (unat (bitsRemaining_C res_ret)) 0) (Cond (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_') SKIP;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')))
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q5439 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s \<and> s' \<in> ?Q'5439 root isSourcea ret___struct_lookupSlot_ret_C a res_ret
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 8. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (11 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (unat (bitsRemaining_C res_ret) \<noteq> 0) = (s' \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}))
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?R'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (throw $ Fault_H.lookup_failure.DepthMismatch (unat (bitsRemaining_C res_ret)) 0) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))
 4. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> ?R5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?R'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret)}
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 9. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 10. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
A total of 11 subgoals...
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (10 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?R5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?R'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (throw $ Fault_H.lookup_failure.DepthMismatch (unat (bitsRemaining_C res_ret)) 0) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> ?R5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?R'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret)}
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 9. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 10. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (10 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst ((throw $ Fault_H.lookup_failure.DepthMismatch (unat (bitsRemaining_C res_ret)) 0) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((\<lambda>st fl es. fl = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall es) (errlookup_fault es) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) st)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) rv (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' s)}
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret)}
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 9. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 10. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (10 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret \<sigma>. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) \<noteq> 0\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = 0 && mask 6, bitsLeft_CL = bitsRemaining_C res_ret && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((throw $ Fault_H.lookup_failure.DepthMismatch (unat (bitsRemaining_C res_ret)) 0) \<sigma>). (\<sigma>', globals_update (\<lambda>x. x\<lparr>current_syscall_error_' := failedLookupWasSource_C_update (\<lambda>_. isSourcea) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (current_syscall_error_' (globals s))), current_lookup_fault_' := ret__struct_lookup_fault_C_' t\<rparr>) s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), ret__struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ((\<lambda>st fl es. fl = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall es) (errlookup_fault es) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) st)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) rv (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' (globals_update (\<lambda>x. x\<lparr>current_syscall_error_' := failedLookupWasSource_C_update (\<lambda>_. isSourcea) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (current_syscall_error_' (globals s))), current_lookup_fault_' := ret__struct_lookup_fault_C_' t\<rparr>) s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), ret__struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), global_exn_var_' := Return\<rparr>)))}
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret)}
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 9. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 10. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (10 subgoals):
 1. \<And>root isSourcea a res_ret \<sigma> x t. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; 0 < unat (bitsRemaining_C res_ret); (\<sigma>, x) \<in> rf_sr; lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = 0, bitsLeft_CL = bitsRemaining_C res_ret && mask 6\<rparr>; lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch\<rbrakk> \<Longrightarrow> EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE \<and> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (failedLookupWasSource_C_update (\<lambda>_. isSourcea) (current_syscall_error_' (globals x)))) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) (Fault_H.lookup_failure.DepthMismatch (unat (bitsRemaining_C res_ret)) 0))
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret)}
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 9. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 10. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (10 subgoals):
 1. \<And>root isSourcea a res_ret \<sigma> x t. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = 0; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; 0 < unat (bitsRemaining_C res_ret); (\<sigma>, x) \<in> rf_sr; lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = 0, bitsLeft_CL = bitsRemaining_C res_ret && mask 6\<rparr>; lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (failedLookupWasSource_C_update (\<lambda>_. isSourcea) (current_syscall_error_' (globals x)))) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) (Fault_H.lookup_failure.DepthMismatch (unat (bitsRemaining_C res_ret)) 0))
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret)}
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 9. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 10. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (10 subgoals):
 1. \<And>root isSourcea a res_ret \<sigma> x t. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = 0; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; 0 < unat (bitsRemaining_C res_ret); (\<sigma>, x) \<in> rf_sr; lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = 0, bitsLeft_CL = bitsRemaining_C res_ret && mask 6\<rparr>; lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch\<rbrakk> \<Longrightarrow> \<exists>z. lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some z \<and> lookup_fault_to_H z = Fault_H.lookup_failure.DepthMismatch (unat (bitsRemaining_C res_ret)) 0
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret)}
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 9. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 10. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (10 subgoals):
 1. \<And>root isSourcea a res_ret \<sigma> x t. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = 0; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; 0 < unat (bitsRemaining_C res_ret); (\<sigma>, x) \<in> rf_sr; lookup_fault_depth_mismatch_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = 0, bitsLeft_CL = bitsRemaining_C res_ret && mask 6\<rparr>; lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some (Lookup_fault_depth_mismatch \<lparr>lookup_fault_depth_mismatch_CL.bitsFound_CL = 0, bitsLeft_CL = bitsRemaining_C res_ret && mask 6\<rparr>)\<rbrakk> \<Longrightarrow> bitsRemaining_C res_ret && mask 6 = bitsRemaining_C res_ret
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret)}
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 9. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 10. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (9 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> ?U'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret)}
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 9. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (9 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?G'5493 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_')
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> {s. s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C\<rparr> \<in> ?G'5493 root isSourcea ret___struct_lookupSlot_ret_C a res_ret})}
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 9. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (9 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; unat (bitsRemaining_C res_ret) = 0\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) (?G'5544 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) [SKIP] (returnOk a) (return_C ret__struct_lookupSlot_ret_C_'_update (\<lambda>b. lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C)))
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> ?U5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret s)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> {s. s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C\<rparr> \<in> {s. s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C)\<rparr> \<in> ?G'5544 root isSourcea ret___struct_lookupSlot_ret_C a res_ret}})}
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 8. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 9. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (8 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C res_ret);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 2. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> True)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> ?PT'5441 root isSourcea ret___struct_lookupSlot_ret_C a res_ret) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> {s. s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C\<rparr> \<in> {s. s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C)\<rparr> \<in> \<lbrace>lookupSlot_ret_C.status_C (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookupSlot_ret_C.slot_C (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C)) = cte_Ptr a\<rbrace>}})}
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 7. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 8. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (7 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C a res_ret s s'. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C res_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; resolveAddressBits_ret_C.slot_C res_ret = cte_Ptr a; bitsRemaining_C res_ret \<le> 0x20; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. unat (bitsRemaining_C res_ret) \<noteq> 0 \<longrightarrow> True) and (\<lambda>s. unat (bitsRemaining_C res_ret) = 0 \<longrightarrow> True)) s \<and> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if bitsRemaining_C res_ret \<noteq> 0 then UNIV else {}) \<longrightarrow> s \<in> {s. s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C\<rparr> \<in> {s. s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C)\<rparr> \<in> \<lbrace>lookupSlot_ret_C.status_C (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> lookupSlot_ret_C.slot_C (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (lookupSlot_ret_C.slot_C_update (\<lambda>_. cte_Ptr a) ret___struct_lookupSlot_ret_C)) = cte_Ptr a\<rbrace>}})}
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 7. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (6 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err rv' res_ret. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup isSource a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (IF resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(IF bitsRemaining_C rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error);;
\<acute>globals :== current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error);;
CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'
FI;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (6 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. b = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall c) (errlookup_fault c) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) a)) \<currency> (\<lambda>a b. b = cte_Ptr a)) (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_') (?QE5074 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) err) (?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret) [SKIP] (throwError err) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_';;
(Cond (if bitsRemaining_C rv' \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_') SKIP;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5074 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned\<rbrace>
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {sa. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''5091 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v t err))})}})}})}}}}
flex-flex pairs:
\<lambda>root isSourcea ret___struct_lookupSlot_ret_C t err. ?Q''5092 root isSourcea ret___struct_lookupSlot_ret_C err (ret__struct_resolveAddressBits_ret_C_' t) (errstate t) \<equiv>\<^sup>? \<lambda>root isSourcea ret___struct_lookupSlot_ret_C. ?Q''5091 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root) proof (prove)
goal (6 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_';;
(Cond (if bitsRemaining_C rv' \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_depth_mismatch_new_'proc(0,bitsRemaining_C rv');;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_') SKIP;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. resolveAddressBits_ret_C.slot_C rv') ret___struct_lookupSlot_ret_C;;
(\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_lookupSlot_ret_C;;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_'))) {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((\<lambda>st fl es. fl = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall es) (errlookup_fault es) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) st)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) rv (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' s)}
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (6 subgoals):
 1. \<And>root isSourcea ret___struct_lookupSlot_ret_C err rv' res_ret \<sigma>. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (resolveAddressBits_ret_C.status_C rv') res_ret; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (current_syscall_error_' (globals s))))) s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), ret__struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ((\<lambda>st fl es. fl = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall es) (errlookup_fault es) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) st)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) rv (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. failedLookupWasSource_C_update (\<lambda>_. isSourcea) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (current_syscall_error_' (globals s))))) s\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), ret__struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C), global_exn_var_' := Return\<rparr>))}
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (6 subgoals):
 1. \<And>root isSourcea rv' res_ret \<sigma> x v. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel (lookup_fault_to_H v) (resolveAddressBits_ret_C.status_C rv') res_ret; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; (\<sigma>, x) \<in> rf_sr; lookup_fault_lift (current_lookup_fault_' (globals x)) = Some v\<rbrakk> \<Longrightarrow> EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE \<and> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (failedLookupWasSource_C_update (\<lambda>_. isSourcea) (current_syscall_error_' (globals x)))) (Some v) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) (lookup_fault_to_H v))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (6 subgoals):
 1. \<And>root isSourcea rv' res_ret \<sigma> x v. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; resolveAddressBits_ret_C.status_C rv' \<noteq> 0; lookup_failure_rel (lookup_fault_to_H v) (resolveAddressBits_ret_C.status_C rv') res_ret; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; (\<sigma>, x) \<in> rf_sr; lookup_fault_lift (current_lookup_fault_' (globals x)) = Some v\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) (failedLookupWasSource_C_update (\<lambda>_. isSourcea) (current_syscall_error_' (globals x)))) (Some v) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) (lookup_fault_to_H v))
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 6. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5086 (word_of_nat depth) root isSourcea capptr\<rbrace> CSpace_H.resolveAddressBits croot capptr depth \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and ?R5086 deptha root isSourcea capptra) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (4 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned x y. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0; Suc 0 \<le> depth \<and> depth \<le> size capptr; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup isSource w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup isSource w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and (\<lambda>a. True \<and> True)) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (4 subgoals):
 1. \<And>root isSourcea x y. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup (to_bool isSourcea) w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y); isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and (\<lambda>a. True \<and> True)) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (5 subgoals):
 1. \<And>root isSourcea y w. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE; lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' y) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR; syscall_error_to_H (current_syscall_error_' (globals y)) (lookup_fault_lift (current_lookup_fault_' (globals y))) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) w)\<rbrakk> \<Longrightarrow> syscall_error_rel (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) w) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (errstate y)
 2. \<And>root isSourcea x y b. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup (to_bool isSourcea) w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y); isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; x = Inr b\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 5. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and (\<lambda>a. True \<and> True)) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (4 subgoals):
 1. \<And>root isSourcea x y b. \<lbrakk>ccap_relation croot root; isCNodeCap croot; word_of_nat depth \<noteq> 0; ((\<lambda>x y z. \<exists>w. x = Fault_H.syscall_error.FailedLookup (to_bool isSourcea) w \<and> y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR \<and> syscall_error_to_H (errsyscall z) (errlookup_fault z) = Some (Fault_H.syscall_error.FailedLookup (to_bool isSourcea) w)) \<currency> (\<lambda>w w'. w' = cte_Ptr w)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y); isSource = to_bool isSourcea; Suc 0 \<le> depth; depth \<le> size capptr; x = Inr b\<rbrakk> \<Longrightarrow> (syscall_error_rel \<currency> (\<lambda>w w'. w' = cte_Ptr w \<and> depth \<le> word_bits)) x (liftxf errstate lookupSlot_ret_C.status_C lookupSlot_ret_C.slot_C ret__struct_lookupSlot_ret_C_' y)
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 4. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and (\<lambda>a. True \<and> True)) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (3 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root; isCNodeCap croot; \<not> (if word_of_nat depth = 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'5003 (word_of_nat depth) root isSourcea capptr ret___struct_lookupSlot_ret_C (cap_get_tag root)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. 0x20) \<acute>current_syscall_error;;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 2. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 3. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and (\<lambda>a. True \<and> True)) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {sa. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'5003 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (2 subgoals):
 1. \<And>deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; ret__unsigned = cap_get_tag root\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4318 deptha root isSourcea capptra ret___struct_lookupSlot_ret_C ret__unsigned) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== failedLookupWasSource_C_update (\<lambda>_. isSourcea) \<acute>current_syscall_error;;
\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_lookupSlot_ret_C :== lookupSlot_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) ret___struct_lookupSlot_ret_C);;
return_C ret__struct_lookupSlot_ret_C_'_update ret___struct_lookupSlot_ret_C_' {},UNIV
 2. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and (\<lambda>a. True \<and> True)) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?PT'4318 deptha root isSourcea capptra (ret___struct_lookupSlot_ret_C_' s) v) \<and> (sa \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> sa \<in> {s. s\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {s. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (1 subgoal):
 1. \<And>deptha root isSourcea capptra s s'. \<lbrakk>deptha = word_of_nat depth; ccap_relation croot root; to_bool isSourcea = isSource; capptra = capptr; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_cap' croot s \<and> depth < 2 ^ word_bits; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> isCNodeCap croot \<longrightarrow> True) and (\<lambda>s. isCNodeCap croot \<longrightarrow> ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. depth < 2 ^ word_bits)) s) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((\<lambda>s. depth < 2 ^ word_bits) and (\<lambda>s. \<not> (Suc 0 \<le> depth \<and> depth \<le> size capptra) \<longrightarrow> True) and (\<lambda>s. Suc 0 \<le> depth \<and> depth \<le> size capptra \<longrightarrow> (valid_pspace' and valid_cap' croot and K (depth \<le> 32) and (\<lambda>a. True \<and> True)) s)) s))) s \<and> s' \<in> {s. s \<in> {sa. sa\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s)\<rparr> \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. root) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrace> \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if deptha = 0 then 1 else 0\<rparr> \<in> {s. ((if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if deptha = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if 0x20 < deptha then 1 else 0\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>(if 0x20 < deptha then 1 else 0) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. n_bits_'_update (\<lambda>_. deptha) (capptr_'_update (\<lambda>_. capptra) (nodeCap_'_update (\<lambda>_. root) s)) \<in> \<lbrace>ccap_relation croot \<acute>nodeCap\<rbrace> \<inter> \<lbrace>\<acute>capptr = capptra\<rbrace> \<inter> \<lbrace>unat \<acute>n_bits = depth\<rbrace>} \<inter> {s. \<forall>t. (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. (case rv of (cte, bits) \<Rightarrow> \<lambda>a. case a of (cte', bits') \<Rightarrow> cte' = cte_Ptr cte \<and> bits = unat bits' \<and> bits' \<le> 0x20) (resolveAddressBits_ret_C.slot_C (ret__struct_resolveAddressBits_ret_C_' t), bitsRemaining_C (ret__struct_resolveAddressBits_ret_C_' t)) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV)) \<and> (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> res_ret_'_update (\<lambda>_. ret__struct_resolveAddressBits_ret_C_' t) (s\<lparr>globals := globals t\<rparr>) \<in> \<lbrace>\<exists>v. lookup_fault_lift \<acute>current_lookup_fault = Some v \<and> lookup_fault_to_H v = err\<rbrace>))})}})}})}}}} proof (prove)
goal (1 subgoal):
 1. \<And>root isSourcea s s'. \<lbrakk>ccap_relation croot root; (s, s') \<in> rf_sr; isSource = to_bool isSourcea; valid_pspace' s; valid_cap' croot s; depth < 2 ^ word_bits; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root\<rparr> \<notin> (if cap_get_tag root \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap then UNIV else {}); word_of_nat depth \<noteq> 0; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<notin> (if 0x20 < word_of_nat depth then UNIV else {})\<rbrakk> \<Longrightarrow> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if unat (word_of_nat depth) = depth then UNIV else {}) \<and> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if \<forall>t. resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> (\<exists>v. lookup_fault_lift (current_lookup_fault_' (globals t)) = Some v \<and> lookup_fault_to_H v = err)) then UNIV else {}) proof (prove)
goal (2 subgoals):
 1. \<And>root isSourcea s s'. \<lbrakk>ccap_relation croot root; (s, s') \<in> rf_sr; isSource = to_bool isSourcea; valid_pspace' s; valid_cap' croot s; depth < 2 ^ word_bits; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root\<rparr> \<notin> (if cap_get_tag root \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap then UNIV else {}); word_of_nat depth \<noteq> 0; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<notin> (if 0x20 < word_of_nat depth then UNIV else {}); cap_get_tag root = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if unat (word_of_nat depth) = depth then UNIV else {}) \<and> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if \<forall>t. resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> (\<exists>v. lookup_fault_lift (current_lookup_fault_' (globals t)) = Some v \<and> lookup_fault_to_H v = err)) then UNIV else {})
 2. \<And>root isSourcea s s'. \<lbrakk>ccap_relation croot root; (s, s') \<in> rf_sr; isSource = to_bool isSourcea; valid_pspace' s; valid_cap' croot s; depth < 2 ^ word_bits; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root\<rparr> \<notin> (if cap_get_tag root \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap then UNIV else {}); word_of_nat depth \<noteq> 0; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<notin> (if 0x20 < word_of_nat depth then UNIV else {}); cap_get_tag root \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if unat (word_of_nat depth) = depth then UNIV else {}) \<and> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if \<forall>t. resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> (\<exists>v. lookup_fault_lift (current_lookup_fault_' (globals t)) = Some v \<and> lookup_fault_to_H v = err)) then UNIV else {}) proof (prove)
goal (2 subgoals):
 1. \<And>root isSourcea s s'. \<lbrakk>ccap_relation croot root; (s, s') \<in> rf_sr; isSource = to_bool isSourcea; valid_pspace' s; valid_cap' croot s; depth < 2 ^ word_bits; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root\<rparr> \<notin> (if cap_get_tag root \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap then UNIV else {}); word_of_nat depth \<noteq> 0; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<notin> (if 0x20 < word_of_nat depth then UNIV else {}); cap_get_tag root \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if unat (word_of_nat depth) = depth then UNIV else {}) \<and> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if \<forall>t. resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> (\<exists>v. lookup_fault_lift (current_lookup_fault_' (globals t)) = Some v \<and> lookup_fault_to_H v = err)) then UNIV else {})
 2. \<And>root isSourcea s s'. \<lbrakk>ccap_relation croot root; (s, s') \<in> rf_sr; isSource = to_bool isSourcea; valid_pspace' s; valid_cap' croot s; depth < 2 ^ word_bits; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root\<rparr> \<notin> (if cap_get_tag root \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap then UNIV else {}); word_of_nat depth \<noteq> 0; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<notin> (if 0x20 < word_of_nat depth then UNIV else {}); cap_get_tag root = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if unat (word_of_nat depth) = depth then UNIV else {}) \<and> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if \<forall>t. resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> (\<exists>v. lookup_fault_lift (current_lookup_fault_' (globals t)) = Some v \<and> lookup_fault_to_H v = err)) then UNIV else {}) proof (prove)
goal (1 subgoal):
 1. \<And>root isSourcea s s'. \<lbrakk>ccap_relation croot root; (s, s') \<in> rf_sr; isSource = to_bool isSourcea; valid_pspace' s; valid_cap' croot s; depth < 2 ^ word_bits; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root\<rparr> \<notin> (if cap_get_tag root \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap then UNIV else {}); word_of_nat depth \<noteq> 0; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<notin> (if 0x20 < word_of_nat depth then UNIV else {}); cap_get_tag root = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if unat (word_of_nat depth) = depth then UNIV else {}) \<and> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := cap_get_tag root, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if \<forall>t. resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> (\<exists>v. lookup_fault_lift (current_lookup_fault_' (globals t)) = Some v \<and> lookup_fault_to_H v = err)) then UNIV else {}) proof (prove)
goal (1 subgoal):
 1. \<And>root isSourcea s s'. \<lbrakk>ccap_relation croot root; (s, s') \<in> rf_sr; isSource = to_bool isSourcea; valid_pspace' s; valid_cap' croot s; depth < 2 ^ word_bits; word_of_nat depth \<noteq> 0; s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := SCAST(32 signed \<rightarrow> 32) cap_cnode_cap, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<notin> (if 0x20 < word_of_nat depth then UNIV else {}); cap_get_tag root = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> s'\<lparr>ret___struct_lookupSlot_ret_C_' := lookupSlot_ret_C.slot_C_update (\<lambda>_. NULL) (ret___struct_lookupSlot_ret_C_' s'), ret__unsigned_' := SCAST(32 signed \<rightarrow> 32) cap_cnode_cap, ret__int_' := if 0x20 < word_of_nat depth then 1 else 0\<rparr> \<in> (if \<forall>t. resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (resolveAddressBits_ret_C.status_C (ret__struct_resolveAddressBits_ret_C_' t)) (errstate t) \<longrightarrow> (\<exists>v. lookup_fault_lift (current_lookup_fault_' (globals t)) = Some v \<and> lookup_fault_to_H v = err)) then UNIV else {}) proof (prove)
goal:
No subgoals!